Skip to main content
Operations

SSL Certificate Monitoring and Expiration Alerts

Monitor SSL certificate status and configure expiration reminders to reduce the risk of certificate-related outages.

CertOne4 min read

Expired certificates can interrupt website access and damage user trust. This guide explains how to monitor certificates and configure reminders so that your team has time to renew them before expiration.

1. Why Monitor Certificates?​

1. Consequences of Expiration​

Business impact:

  • Visitors cannot access the website normally.
  • Users see security warnings.
  • Security warnings reduce trust.
  • Service disruption can result in business losses.

Operational impact:

  • Emergency certificate replacement takes time.
  • Multiple services may be affected.
  • Recovery may require coordination across teams.

2. Benefits of Monitoring​

  • ✅ Detect approaching expiration dates.
  • ✅ Allow enough time for renewal.
  • ✅ Reduce emergency maintenance.
  • ✅ Maintain service continuity.

2. Certificate Monitoring in CertOne​

1. Create a site monitor​

  1. Sign in to CertOne
  2. Open the certificate monitoring page.
  3. Click "Create Monitor".
  4. Enter the monitoring details.

2. Monitoring Settings​

Domain:

  • Enter the domain to monitor.
  • Monitor certificates on publicly reachable domains, including certificates issued elsewhere.

Port:

  • The default port is 443.
  • A custom port can be specified.

IP address:

  • Optionally specify the IP address to check.
  • Multiple IP addresses can be monitored.

3. Notification Settings​

Email notifications:

  • Expiration reminders 20 days in advance
  • Configure one or more notification email addresses.

Reminder schedule:

  • Example first reminder: 20 days before expiration.
  • Example follow-up: 7 days before expiration.
  • Example final reminder: 1 day before expiration. Check the actual schedule configured for your monitor.

3. Build Your Own Monitor​

1. Monitor with a Script​

Create check-cert.sh:

#!/bin/bash

DOMAIN="example.com"
DAYS_BEFORE_EXPIRE=30
NOTIFY_EMAIL="admin@example.com"

# Retrieve the certificate expiration date
EXPIRE_DATE=$(echo | openssl s_client -connect $DOMAIN:443 -servername $DOMAIN 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)

# Convert the date to a Unix timestamp
EXPIRE_TIMESTAMP=$(date -d "$EXPIRE_DATE" +%s)
CURRENT_TIMESTAMP=$(date +%s)

# Calculate the number of days remaining
DAYS_LEFT=$(( ($EXPIRE_TIMESTAMP - $CURRENT_TIMESTAMP) / 86400 ))

# Check whether a reminder is required
if [ $DAYS_LEFT -lt $DAYS_BEFORE_EXPIRE ]; then
    echo "The certificate expires in $DAYS_LEFT days." | mail -s "SSL Certificate Expiration Warning" $NOTIFY_EMAIL
fi

2. Schedule the Script​

# Add this entry to crontab
crontab -e

# Check once per day
0 0 * * * /path/to/check-cert.sh

4. Third-Party Monitoring Tools​

1. UptimeRobot​

Features:

  • Monitor SSL certificate expiration.
  • Send email and SMS reminders where supported by the plan.
  • Monitor quotas and SSL monitoring availability depend on the selected plan.

Configuration:

  1. Create an UptimeRobot account.
  2. Add an SSL certificate monitor where supported.
  3. Configure notification channels.

2. Pingdom​

Features:

  • Monitor SSL certificate status.
  • Send alerts.
  • Provide detailed reports.

Configuration:

  1. Create a Pingdom account.
  2. Add an SSL monitor where supported.
  3. Configure alert rules.

3. SSL Labs API​

Features:

  • Query the SSL Labs API.
  • Retrieve detailed SSL configuration information.
  • Integrate the results into your own system.

Usage:

curl "https://api.ssllabs.com/api/v3/analyze?host=example.com"

5. Monitoring Best Practices​

1. Monitoring Strategy​

Escalating reminders:

  • 30 days before expiration: Initial reminder
  • 7 days before expiration: Follow-up reminder
  • 1 day before expiration: Urgent reminder

Multiple notification channels:

  • Email
  • SMS for critical certificates
  • DingTalk or WeCom notifications
  • Phone calls for urgent incidents

2. Monitoring Coverage​

Include all certificates:

  • Production certificates
  • Test environment certificates
  • Internal service certificates
  • CDN certificates
  • Load balancer certificates

3. Monitoring Frequency​

Check intervals:

  • Daily checks for routine monitoring
  • Less frequent checks only where the risk and certificate lifetime permit
  • Frequent checks for critical certificates

6. Alert Configuration​

1. Alert Severity​

Example severity levels:

  • 30 days before expiration: Warning
  • 7 days before expiration: High priority
  • 1 day before expiration: Critical

2. Alert Channels​

Email alerts:

  • Send to the responsible administrators.
  • Include certificate details.
  • Include a link to the renewal workflow.

SMS alerts:

  • Use for critical certificates.
  • Use for urgent incidents.
  • Requires an SMS service integration.

System integrations:

  • Integrate with the monitoring system.
  • Forward events to the alerting platform.
  • Record events in the logging system.

7. Certificate Renewal Workflow​

1. Identify Certificates Due for Renewal​

  1. Receive the monitoring alert.
  2. Confirm the expiration date.
  3. Assess the affected services.

2. Prepare the Renewal​

  1. Obtain a new certificate
  2. Prepare a rollout plan.
  3. Notify the relevant teams.

3. Perform the Renewal​

  1. Renew the certificate
  2. Deploy the certificate to the server.
  3. Validate the deployed certificate.

4. Verify Service Health​

  1. Check HTTPS access
  2. Run an SSL configuration check.
  3. Confirm that all services are operating normally.

8. Automated Monitoring and Renewal​

1. Renew automatically with CertOne​

  1. Enable auto-renewal in the certificate settings
  2. Configure a suitable renewal lead time, such as 30 days where supported.
  3. Configure automatic deployment.
  4. The system renews and deploys the certificate automatically.

2. Renew with acme.sh​

# acme.sh installs a renewal cron job.
# Check for and renew eligible certificates
crontab -l | grep acme.sh

3. Renew with Certbot​

# Certbot packages may install a systemd renewal timer.
# Check for and renew eligible certificates
sudo systemctl list-timers | grep certbot

9. Common questions​

1. Incorrect Monitoring Results​

Issue: The monitor reports an expired certificate, but the certificate appears valid.

Resolution:

  • Check the monitoring script logic.
  • Verify time zone settings.
  • Confirm the expiration date of the certificate actually served by the endpoint.

2. Missing Alerts​

Issue: A certificate is approaching expiration, but no alert arrived.

Resolution:

  • Check the email settings.
  • Check the spam folder.
  • Verify the alert configuration.

3. False Positives​

Issue: The monitor frequently sends incorrect alerts.

Resolution:

  • Review and improve the monitoring script.
  • Set appropriate alert thresholds.
  • Identify and address the causes of false positives.

10. Best Practices Checklist​

1. Monitoring Configuration​

  • ✅ Monitor every certificate.
  • ✅ Configure escalating reminders.
  • ✅ Use multiple notification channels.
  • ✅ Check monitor health regularly.

2. Automation​

  • ✅ Enable automatic renewal
  • ✅ Configure automatic deployment.
  • ✅ Minimize manual intervention.

3. Incident Readiness​

  • ✅ Prepare an emergency renewal procedure.
  • ✅ Maintain a certificate inventory.
  • ✅ Document the renewal process.

Conclusion​

Certificate monitoring provides advance notice of approaching expiration dates. Effective alerts give your team time to renew certificates before services are disrupted.

Key points:

  • ✅ Monitor every certificate.
  • ✅ Configure escalating reminders.
  • ✅ Use automation tools.
  • ✅ Prepare an incident response procedure.

CertOne combines certificate monitoring and reminders with automatic renewal and deployment to simplify ongoing certificate operations.