SSL certificate monitoring
An expired certificate takes a site down as surely as a crashed server, and usually at a worse time. SSL monitoring warns you days ahead and checks the chain is valid every time.
Two ways to watch a certificate
SSL certificate monitors
An SSL monitor connects to a host on a port you choose (443 unless you say otherwise), completes a TLS handshake with the right server name, and reads the certificate the server presents. It goes down when:
- the certificate expires within the number of days you set (1 to 90, 14 by default),
- the certificate has expired,
- the chain can't be verified against trusted root certificates, for example a missing intermediate,
- the certificate is self-signed,
- or the certificate doesn't cover the host name.
The alert says which, so "SSL certificate expires in 9 days" and "SSL certificate chain can't be verified" lead to different fixes.
Expiry warnings on website monitors
Every HTTPS website monitor reads the certificate too. When it's close to expiry you get a warning, by default 14 days ahead, without the site being marked as down. A certificate that has expired fails the check, because the request itself fails verification.
Why certificates still expire
Automatic renewal has made expiry rarer, not impossible. Renewal jobs fail silently when DNS changes, when a firewall blocks the validation request, when a server is rebuilt without its renewal timer, or when a certificate on a load balancer or CDN is managed somewhere else entirely. A check from outside, against what visitors actually receive, catches all of these.
Pair SSL monitoring with a heartbeat on the renewal job itself and you'll know both when renewal stops running and when a certificate gets close to the end.
Chain problems
A server that sends its own certificate without the intermediate often works in desktop browsers, which fill the gap from a cache, while failing in mobile apps, API clients and command-line tools. Uptime Dog verifies the chain the server actually sends, so you see the problem those clients see.
Check a certificate now
Use the free SSL checker to see any public site's issuer, expiry date, names covered and whether the chain is trusted. When you want to hear about problems without remembering to look, add an SSL monitor.
Included on every plan
SSL monitors count towards your monitor limit like any other monitor, including on the Free plan with 20 monitors. Checks run as often as your plan allows, from every 5 minutes on Free to every 20 seconds on Business, though a certificate check once an hour is plenty. Alerts go to any channel.
Set up your first monitor in under a minute
Uptime Dog is free for up to 20 monitors. No card needed.
Start monitoring free