How to monitor SSL certificate expiry

  • basics
  • ssl

Certificates don't fail loudly until the day they fail completely. The renewal cron stops, a firewall rule blocks the ACME challenge, a DNS change breaks validation - and nothing tells you, because the current certificate keeps working right up to its notAfter second. Monitoring expiry means watching that date from outside, continuously, so a stalled renewal surfaces while it is still a chore instead of an outage.

How do I check a certificate's expiry date right now?

One command, from any machine:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate

notAfter is the expiry. Two habits make the answer trustworthy:

  • Keep -servername. Without it you may read a different certificate than browsers get on a server hosting several sites.
  • Check www and the apex separately. They can carry different certificates with different expiry dates - renewing one and not the other is a classic partial outage.

Behind a CDN, remember there are two certificates: the edge one your visitors see (usually auto-managed) and your origin's. The command above reads whichever endpoint you point it at, so check both.

Why isn't a calendar reminder enough?

Because the date moves. Let's Encrypt certificates live about 90 days and renew on their own schedule; a reminder set at issue time is stale after the first successful auto-renewal, and the person who set it may not be the person who rotated the certificate. Reminders also fail silently in the exact scenario that matters: auto-renewal breaking mid-cycle. The reminder says "fine until October"; the renewal that was supposed to happen in August already failed.

A cron job running the openssl line and emailing on a low day count is the self-hosted fix, and it works - until the box running the cron is the thing that breaks, or the email lands in spam. Whoever monitors the monitor has this problem all the way down; at some point you want the watcher outside your own infrastructure.

What should automatic monitoring actually watch?

Three things, because they fail independently:

  1. Days until expiry, read from the live endpoint - not from your renewal tooling's logs, which describe what it tried, not what a visitor sees.
  2. Every hostname that matters - apex, www, API subdomains. Each is its own certificate check.
  3. From outside your network, so the check survives whatever breaks your infrastructure.

YoPingMe's SSL check does exactly this on the free plan: it reads the certificate from both of your check regions on every run and alerts by email, webhook, or Slack when expiry approaches or the certificate stops validating - so a stalled renewal surfaces weeks before browsers start warning, on a channel you actually read. Ten monitors are free; pair the SSL check with an HTTP check on the same host and you're covered for both the slow failure (expiry creeping closer) and the fast one (the site going down). The first check runs while you sign up.