What is SSL certificate expiry monitoring?

It is the automated, continuous checking of a site's TLS/SSL certificate to see how many days remain before it expires, and to alert someone before that happens. Good monitoring also checks that the certificate is actually valid: correct hostname, complete chain, trusted issuer. It exists because an expired certificate blocks every visitor with a full-screen browser warning.

How do I check when an SSL certificate expires?

In the browser, click the lock icon in the address bar and open the certificate details to see the "Valid to" date. From the command line, run `openssl s_client -connect example.com:443 -servername example.com` and read the `notAfter` value. Both work for a single site, but neither scales when you manage dozens of client domains.

Why do SSL certificates expire if auto-renewal is set up?

Because auto-renewal is a scheduled job that can fail silently. Common causes are a failed Let's Encrypt cron, a validation challenge blocked by a firewall or a DNS change, a certificate that renewed on disk but was never reloaded by the web server, and a CDN holding a separate certificate at the edge. Subdomains often have their own certificates that nobody renews at all.

What happens if an SSL certificate expires?

Browsers stop rendering the site and show a full-screen security warning instead, so traffic collapses within minutes. Forms, logins and checkouts fail, tracking scripts never fire, and search engine crawlers see the site as unreachable. A long outage can cost rankings on top of the lost revenue.

Does Deltio alert me before an SSL certificate expires?

Yes. Deltio checks the certificate on every monitored site, shows days to expiry and the issuer, and sends a warning 30 days before expiry and again 1 day before. If the certificate is not valid, Deltio notifies you immediately. Alerts arrive by email and Slack.

How much does Deltio cost?

Deltio starts at £24 a month on the Starter plan, or £20 a month if you pay annually. Professional is £49 a month and Enterprise is £119 a month. Every plan comes with a 14-day free trial.

← Back to the blog

SSL Certificate Expiry Monitoring: Stop Finding Out From a Client

SSL certificate expiry monitoring means checking automatically and continuously how many days are left before a site's TLS certificate expires, and alerting you before it does. When a certificate expires the browser blocks the page with a full-screen warning, traffic drops to near zero within minutes, and forms and checkouts stop working. Checking by hand with the lock icon or openssl works for one site, but it does not scale across a client portfolio. Deltio monitors the certificate on every site you manage from a single account, shows days to expiry and issuer, and warns you at 30 days and again at 1 day, from £20 a month with a 14-day free trial.

Nobody plans to let a certificate expire. It happens anyway, usually on the site you inherited from another agency, on a Saturday, on a subdomain nobody remembered. The first person to notice is almost never you. It is the client.

What actually happens when a certificate expires

The browser blocks the page. Chrome shows NET::ERR_CERT_DATE_INVALID full screen, in red. Most visitors take the button back to safety.
Traffic goes to zero in minutes. Analytics flatlines: the page never loads, so the tracking script never fires.
Forms and checkouts stop. Payments, lead forms, logins. Anything posted over HTTPS fails.
Googlebot sees an unreachable site. Crawling drops off, and a multi-day outage can cost rankings that took months to earn.
APIs break in silence. Webhooks and server-to-server calls reject the certificate and warn nobody.

Why certificates expire even with auto-renewal

Auto-renewal is a cron job, and cron jobs fail.

The renewal job fails quietly. Certbot hits an error, writes it to a log nobody reads, and exits. Ninety days later the certificate is gone.
Validation stopped working. The HTTP-01 challenge path is blocked by a firewall rule or a WAF, or DNS moved and DNS-01 no longer resolves.
Renewed, but never reloaded. Nginx or Apache still serves the old certificate from memory: fine on disk, expired in the browser.
The CDN has its own certificate. Cloudflare or a load balancer terminates TLS at the edge: the origin is fresh, the edge is not, or the other way round.
Subdomains are uncovered. The certificate covers example.com and www.example.com. Nobody thought about shop., blog. or staging, and each has its own expiry date.

How to check a certificate by hand

Browser: click the lock icon in the address bar, open the certificate details, read "Valid from" and "Valid to".
Command line: run openssl s_client -connect example.com:443 -servername example.com and read the notBefore and notAfter dates. Without -servername you get the default certificate on a shared IP, not the one for that hostname.

Now do that for 30 client sites, plus subdomains, plus staging, every week, forever. Manual checks hold up until the week you are busy, which is the week something expires. Same logic for the rest of the site: see our website monitoring checklist for agencies.

What to monitor, beyond the expiry date

Days remaining: the number you act on. Thirty days is enough to raise a ticket.
Issuer: who signed the certificate. If it changes and nobody told you, something moved in the hosting or the CDN.
Chain validity: a certificate can be in date and still invalid. A missing intermediate or a hostname mismatch gives the same red screen.

An expired certificate is a downtime event, so treat it like one. Same as uptime alerts.

How Deltio does it

Days to expiry and issuer, per site in the dashboard.
A warning at 30 days before expiry, and a second one at 1 day.
An immediate notification if the certificate is not valid, not only when it is close to expiring.
Alerts by email and Slack, in your language and your timezone.

SSL sits alongside the other checks Deltio runs on the same site: uptime every 10 minutes, domain expiry via RDAP, robots.txt changes and sitemap diffs. One account, every client, which is the point when you are monitoring client websites rather than one of your own.

Start with the site you would hate to lose

Add one domain and let Deltio read the certificate. Then add the rest of the portfolio. Plans start at £24 a month (£20 annually), with a 14-day free trial.

Frequently asked questions

What is SSL certificate expiry monitoring?: It is the automated, continuous checking of a site's TLS/SSL certificate to see how many days remain before it expires, and to alert someone before that happens. Good monitoring also checks that the certificate is actually valid: correct hostname, complete chain, trusted issuer. It exists because an expired certificate blocks every visitor with a full-screen browser warning.
How do I check when an SSL certificate expires?: In the browser, click the lock icon in the address bar and open the certificate details to see the "Valid to" date. From the command line, run `openssl s_client -connect example.com:443 -servername example.com` and read the `notAfter` value. Both work for a single site, but neither scales when you manage dozens of client domains.
Why do SSL certificates expire if auto-renewal is set up?: Because auto-renewal is a scheduled job that can fail silently. Common causes are a failed Let's Encrypt cron, a validation challenge blocked by a firewall or a DNS change, a certificate that renewed on disk but was never reloaded by the web server, and a CDN holding a separate certificate at the edge. Subdomains often have their own certificates that nobody renews at all.
What happens if an SSL certificate expires?: Browsers stop rendering the site and show a full-screen security warning instead, so traffic collapses within minutes. Forms, logins and checkouts fail, tracking scripts never fire, and search engine crawlers see the site as unreachable. A long outage can cost rankings on top of the lost revenue.
Does Deltio alert me before an SSL certificate expires?: Yes. Deltio checks the certificate on every monitored site, shows days to expiry and the issuer, and sends a warning 30 days before expiry and again 1 day before. If the certificate is not valid, Deltio notifies you immediately. Alerts arrive by email and Slack.
How much does Deltio cost?: Deltio starts at £24 a month on the Starter plan, or £20 a month if you pay annually. Professional is £49 a month and Enterprise is £119 a month. Every plan comes with a 14-day free trial.