Over the years, I've been caught out by expired certificates far too often, and I've promised myself that it ends here.
For many people, the reminder to renew a certificate is customers complaining that the site can't be reached. That's the reminder I want to replace with an e-mail that comes in time.
Why it keeps happening
Most certificates renew themselves, so nobody thinks about them. Then a server moves, a renewal job stops, or a CDN keeps serving the old certificate, and nothing tells you until the day it runs out. Why certificates expire even with auto-renewal goes through the usual causes.
It's also going to happen more often. Since March 2026 a new certificate lasts at most 200 days, and the CA/Browser Forum has agreed to bring that down to 47 days by 2029. More renewals mean more chances for one of them to go wrong. Certificate lifetimes are getting shorter has the dates.
What SSL Monitor does today
- Every day, it connects to each of your hosts over a real TLS handshake and reads the certificate the server sends.
- It checks the expiry, the chain and the TLS settings.
- It e-mails you while there's still time to renew. On SSL Pro and Business, alerts can also go to Slack, Microsoft Teams or a webhook.
- SSL Pro is €18 a month for 20 hosts, and SSL Business €49 for 150. The free plan watches 3 hosts for personal and hobby sites.
SSL Monitor warns you. The renewal itself is still done by your server, your host or your certificate provider.
Should SSL Monitor renew certificates too?
I'm considering adding certificate renewal if it gains traction. Let me know if that would interest you: christian@monitorbase.eu. Tell me a little about where your certificates live today, and you'll get an answer within 1–2 days.