SSL certificate expiry monitoring with early alerts

You hear about a client's expiring certificate from OctoPing weeks before a visitor sees a browser warning.

How certificates expire without anyone noticing

Auto-renewal covers most certificates until the day it doesn't. A DNS change breaks the validation step, a server gets rebuilt without the renewal job, or a certificate bought by hand lapses because the person who bought it moved on. Nothing about the site changes until the certificate runs out, and then every visitor gets a full-page warning. In our experience the first report comes from a client who forwards a screenshot.

What OctoPing checks

Every new site has SSL monitoring switched on. OctoPing opens a secure connection to the site's HTTPS address (port 443 unless the URL names another), completes the handshake and reads the certificate the server presents. It stores the issuer, the name on the certificate, the dates it is valid from and until, and the days left.

The default is one check every day, and you can choose every hour, every 6 hours, every 12 hours, every day or every week for each site. A site whose URL starts with http:// has no certificate to read, so it's skipped without an error. The result history sits on the site's page, next to the other checks.

When it alerts

• Expiring soon. When the days left drop to your warning window or below. The window is 30 days unless you change it, and you can set anything from 1 to 90 days per site. The warning repeats, at most once a day, until the certificate is renewed.
• Already invalid. A certificate that fails verification, for example because it has expired, is self-signed or was issued for another name, is recorded as invalid with the reason and its dates, so the site's page can show how long ago it expired. It doesn't send the expiry warning. The uptime check picks it up instead: the site fails with a TLS/SSL error, and the down alert names that cause.

If OctoPing can't connect to run the check, it records the error and tries again at the next scheduled check without alerting.

One check per site

A site is one URL, so example.com and www.example.com are two sites with a certificate check each. The certificate is read from the primary checker, which means a CDN that serves different certificates in different regions shows you the one the primary checker is served.

After you renew

The next scheduled check reads the new certificate and stores its dates. The days left jump back up, and the warnings stop once that number is above your warning window. The earlier results stay in the site's history, so you can see when each certificate was replaced.

What the alert says

The subject names the site and the days remaining. It carries a WARNING label at 14 days or fewer and URGENT at 7 days or fewer. The body gives the days left and the issuer, so whoever reads it knows which certificate to renew and where it came from.

Website: https://example.com
Status: SSL certificate expiring soon

Days until expiry: 12
Certificate issuer: Example CA

Please renew the SSL certificate before it expires to avoid
service disruptions and browser security warnings.

View details in OctoPing: <link to the site>

The warning follows the down-alert switch on each alert rule, so it reaches the email, Slack, Discord, webhook and browser push channels you've set up for that site. The monthly summary email also lists the days left on each site's certificate.

If you've added a client as a contact on a status page that shows the site, they get the warning too. Contacts hear about an expiring certificate at most once every three days.

How it fits the price

Every site gets ssl certificate monitoring along with uptime, SSL and the other checks, and no plan limits which checks a site can use. Plans start at $19 a month for 20 sites. See pricing for the full list.

Every account starts with a 14-day free trial. No card required. Start your 14-day trial, add a client's site, and the checks you turn on start with it.