SSL monitoring
SSL certificate monitoring, so visitors never see a warning.
An expired certificate takes a working site offline: browsers show a full-page warning and most visitors leave. SSL certificate monitoring checks every certificate on a schedule and warns you before the expiry date, not after. Free for 5 domains, once a day. Want a single check right now? Use the free SSL checker.
What we check
Each SSL check connects to your domain on port 443, reads the certificate the server sends and compares it with what browsers expect.
-
Expiry date
How many days are left. You are warned in good time before the date and alerted when the certificate has expired.
-
Chain
Whether the server sends the intermediate certificates browsers need. A missing link in the chain fails in some browsers and in most apps.
-
Hostname
Whether the certificate is valid for the name visitors type, including www and without. A certificate for the wrong name is as bad as none.
-
Trust
Whether the certificate traces back to a trusted authority. Self-signed or unknown issuers are flagged.
-
Renewal that failed silently
Automatic renewal with certbot or a similar tool can fail for months without anyone noticing. The check sees the old certificate still in use and tells you.
-
All names, one list
Every certificate with its expiry date in one list, so you see at a glance which one is next.
When we alert you
Alerts go out by email and app push, on paid plans also by Telegram or webhook. On a status page, a certificate problem is shown as an incident, so your customers know it is being handled.
- A warning before the expiry date, early enough to renew by hand if the automatic renewal has failed
- An alert when the certificate has expired, the chain is incomplete or the hostname does not match
- An alert when the certificate changes unexpectedly, for example to one from a different issuer
- All clear as soon as a valid certificate is in place again
Free for 5 domains
The free plan includes 5 SSL checks that run once a day. Paid plans include more checks and shorter intervals; see the plans and prices. Website monitoring is separate: the SSL check looks at the certificate, the website check at the page itself. Most people use both on the same domain.
- Free: 5 SSL checks, once a day, alerts by email and app
- Paid plans: more SSL checks, more often, plus Telegram and webhooks depending on plan
- An SSL check counts as one monitor; the plan limits are in the comparison table
Expired already? We can renew it.
-
Check
The free SSL checker tells you whether the certificate has expired, the chain is broken or the name does not match.
-
Quick fix
On your own server or in a webspace with SSH access, a quick fix renews the certificate where certbot or a similar tool is set up and reloads the web server. Fixed price, shown before you order.
-
Deep fix
No automatic renewal in place, a changed DNS record, a web server that will not reload: a deep fix takes over, around the clock, billed in 15-minute blocks. The estimate is the upper limit.
If the certificate is managed by your host or a site builder, only they can renew it. You get a ready-to-send message for them.
Questions about SSL monitoring
What happens when an SSL certificate expires?
Browsers block the site with a full-page security warning ("Your connection is not private"), and services that call your site refuse the connection. For visitors the site is down, even though the server runs. See the guide on the expired certificate warning.
How early will I be warned?
Well before the expiry date, with time to renew by hand, and again when the date is close. Certificates from Let's Encrypt run for 90 days and are usually renewed automatically about 30 days before expiry; the warning is your sign that this renewal has failed.
How often is the certificate checked?
Once a day on the free plan, more often on paid plans. A certificate does not change by the minute, so a daily check catches every expiry in time.
Does the check slow down my site?
No. It opens one connection, reads the certificate and closes it. Your web server does not notice it.
Can you also monitor the certificate of my mail server?
Yes, as part of the mail delivery check, which also looks at the certificate your mail server presents for STARTTLS. Mail DNS (SPF, DKIM, DMARC) is a separate check.
Can you renew certificates for me?
On your own server or in a webspace with SSH access, yes: a quick fix renews the certificate where certbot or a similar tool is set up. If no automatic renewal exists yet, a deep fix sets it up. Certificates managed by your host or a site builder can only be renewed there.
Never find out from a visitor again.
Add your domains, get warned before a certificate expires, and if one has already expired, let us renew it.
Related: SSL checker · "Your connection is not private" · Fixes when something breaks · Website monitoring · Plans and pricing