Technical guide
How to get SSL certificate expiration alerts
A useful alert leaves enough time to renew, deploy, and verify. Start with a service inventory, not an isolated calendar reminder.
The problem
Certificates live across providers and renewal cycles. A team may renew issuance but fail to deploy the result to a load balancer, API, or alternate port.
Risks and assumptions
Website, API, or integration downtime after certificate expiry.
Late warnings that leave no room for approval and deployment.
Coverage gaps when only the apex domain is checked.
Procedure
Inventory hostnames and ports
Include websites, APIs, admin surfaces, and non-standard endpoints that actually present TLS.
Record issuer, SAN, and notAfter
The date alone does not prove hostname coverage or expected chain.
Set staged warning windows
Use early notices for planning and closer windows for escalation based on real lead time.
Assign an owner
Every alert needs ownership and a runbook that ends with a post-deployment check.
Limits of a manual approach
A calendar does not discover new certificates or endpoint changes.
ACME reduces work but challenges, permissions, limits, or deployment can still fail.
A spot check does not preserve change evidence.
Example
For a September 30 expiry with approval lead time, a 60-day warning opens the task, 30 days confirms progress, and 14/7-day windows escalate if the endpoint still serves the old certificate.
Common mistakes
Monitoring only `example.com` and missing `api.example.com`.
Confusing an issued renewal with a deployed renewal.
Creating an alert without an owner or escalation path.
Recommendations
Verify the certificate presented after every deployment.
Keep issuer, fingerprint, and chain history to detect unexpected rotation.
Tune windows by criticality and process duration.
Frequently asked questions
How many days before expiry should I alert?
It depends on the process. Thirty days is a common baseline; critical or manual renewals may need 60 or 90.
Does ACME remove the need for monitoring?
No. Issuance automation can still fail at challenge, job, permission, or deployment stages.
Do checks require the private key?
No. Expiry and chain metadata come from the public certificate served by the endpoint.
Automate certificate checks
Monitor certificates across domains and send owners the context needed to act.
Explore the moduleRelated content
Certificate lifecycle
SSL/TLS certificate monitoring and expiration alerts
Monitor SSL/TLS certificates across multiple domains, receive expiry alerts, and detect unexpected certificate-chain or TLS posture changes.
Technical guide
SSL monitoring vs. manual certificate checks
Compare browsers, OpenSSL, and point-in-time checkers with continuous certificate monitoring, change history, and expiry alerts.
Free tool
SSL certificate checker
Check the TLS certificate served on port 443, including issuer, coverage, validation, and days remaining, without sending private keys.