SSL certificate monitoring

Your SSL certificate is what puts the padlock in the browser and keeps traffic to your site private. It also has a fixed expiry date, and if that date passes your visitors see a full-page security warning instead of your website. SSL monitoring reads the live certificate, tracks the date it runs out, and warns you in good time so a renewal is a calm task rather than a weekend emergency.

What a certificate does, and what this check covers

Every secure website has a certificate. It does two jobs at once: it encrypts the data going back and forth so nobody in between can read it, and it proves to the browser that your site is genuinely yours. That is the difference between an address that starts https:// with a padlock and one the browser flags as unsafe.

Certificates are issued for a fixed period and then have to be renewed. Many renew automatically. The popular free Let's Encrypt certificates, for example, last only 90 days and are meant to renew on their own in the background. Because the lifetime is so short, a renewal that quietly stops working can take a site down within weeks, not months. SSL monitoring watches the one thing that matters most here: the expiry date on the certificate that is actually being served to the public right now.

How TLDTrack checks it

On a regular cycle, roughly every 12 hours, TLDTrack connects to your site, reads the certificate it serves, and records two things: the exact date it expires and who issued it. From there it counts down to the expiry date and decides whether it is time to warn you.

• We track the real expiry date held in the served certificate, not an estimate.
• We record the issuer, so you can see at a glance whether a site is on Let's Encrypt, a paid certificate, or something else.
• If TLDTrack cannot read a certificate at all, it does not raise an alert. It tries again 24 hours later. The check watches the expiry date; it does not test whether browsers trust the certificate.
• When a certificate is renewed, the next check picks up the new expiry date automatically and the countdown resets, so you never have to update anything by hand.

When the warnings arrive, and what each one means

Most of the time there is nothing to do: the number simply ticks down and resets itself each time the certificate renews. TLDTrack stays quiet until a certificate is genuinely getting close to its end date, then the alerts step up in urgency as the deadline nears:

• About a month out. A first, low-urgency heads-up that a certificate is approaching its expiry and has not renewed yet. Plenty of time to check the renewal is set up.
• About two weeks out. The warning is raised to a higher priority. If nothing has renewed by now, it is worth confirming why.
• The final week. A critical alert. Renew immediately, by hand if you have to, rather than waiting for the automation to catch up.
• Expired. The alert stays critical. At this point visitors are seeing the browser security warning, so treat it as an outage.

The email goes out when the alert first opens. As the date gets closer, the same alert moves up in priority on your Alerts screen; it does not send a new reminder email at two weeks or one week.

As soon as a healthy certificate is back in place, TLDTrack clears the alert on its own. You do not have to mark anything as resolved.

What you need before you start

• A site served over HTTPS. SSL monitoring reads the certificate on the secure version of your site. A site that only answers on plain http:// has no certificate to read.
• The site reachable from the public internet. TLDTrack checks from our servers, not from inside your office or VPN, so the secure site needs to answer a request from outside your own network.
• The SSL check switched on for that site. It is a per-site toggle, so you control which of your sites are watched.
• At least one notification contact with an email address. The SSL email goes to every active contact with an email address. With none, the alert is recorded in the dashboard but nobody is emailed. See alerts and notifications.

What you will see, and what to do

On a site's Monitoring tab you will see the SSL check, the issuer, and the expiry date it is counting down to. The moment to act is when an alert arrives:

• An expiry warning. The certificate is getting close to its end date and has not renewed yet. Check with whoever manages your hosting or your certificate that the renewal is set up, or renew it yourself if you do it by hand.
• Missing certificate details. This one does not send an alert. If the Monitoring tab shows no issuer or expiry date, TLDTrack could not read a certificate, so check the site in a browser yourself.
• The countdown reset after a renewal. Once you or your host renews, confirm on the next check that the new date has been picked up, so you know the renewal actually took.

How to switch it on, step by step

1. 1
   Open the website from your Domains list. If you have not added it yet, see Add your first website.
2. 2
   Go to the Monitoring tab and switch on the SSL check for that site.
3. 3
   Set or review your notification contacts, and make sure at least one has an email address, because the SSL email goes to every active contact with one.
4. 4
   That is it. The first check runs shortly after, records the certificate's expiry date and issuer, and from then on the countdown keeps itself up to date on its own.

Your domain name has its own separate expiry, and so does the certificate. They are easy to confuse but they are not the same thing. See domain expiry and renewals for the other one, and DNS monitoring for the records that decide where the secure site actually lives.

Where to set this up

Good to know

• SSL checks run roughly every 12 hours per site, quietly, with no action needed from you.
• When several certificates need attention at once, TLDTrack sends a single consolidated email rather than one message per site, so your inbox stays calm.
• Watching a certificate does not use any credits or allowance.
• A renewed certificate is picked up automatically on the next check, and any open expiry alert clears itself.