SSL certificate expiry is one of those outages that feels embarrassing precisely because it is entirely preventable. The cert expires, browsers slam the door shut, and your users see a skull-and-crossbones warning screen instead of your product. It happens to huge companies. It happens to careful engineers. And it almost always happens because nobody was watching.
This article covers why SSL expiry is so damaging, how automated monitoring catches it before it bites you, and how to get protected in under five minutes.
The Real Cost of a Expired SSL Certificate
When your certificate expires, modern browsers do not silently fall back to HTTP. They block the connection entirely. Chrome shows a full-page red warning: "Your connection is not private (NET::ERR_CERT_DATE_INVALID)". Firefox says "Warning: Potential Security Risk Ahead". Safari is equally aggressive. Every browser puts a huge friction wall between your visitor and your site.
The downstream effects compound quickly:
- Revenue loss. If you run an e-commerce site or SaaS, most users will not click through a security warning. Conversion drops to near zero while the cert is expired.
- Search ranking damage. Google has used HTTPS as a ranking signal since 2014. While a short-lived expiry may not permanently tank your rankings, a crawl hit during a multi-hour outage will register as unavailability and can affect your position in SERPs.
- API and webhook failures. Any downstream service or partner that calls your API will start receiving TLS handshake errors. Background integrations fail silently until someone notices.
- Trust erosion. Even after you renew the cert and the site comes back, users who saw the warning will remember it. B2B customers in particular treat security incidents as a red flag during vendor reviews.
A notable real-world example: in 2020, Microsoft Teams suffered a major outage partly triggered by a forgotten SSL certificate. The incident affected hundreds of thousands of users and made headlines. The root cause was a monitoring gap, not incompetence.
How Vigilmon Monitors SSL Certificate Expiry
Vigilmon includes SSL certificate monitoring as a first-class built-in check alongside standard uptime monitoring. You do not need a separate tool or a cron job.
When you add an HTTPS monitor, Vigilmon automatically:
- Checks your TLS certificate on every ping - verifying the cert is valid, trusted, and matches the hostname.
- Reads the expiry date from the certificate and tracks how many days remain.
- Triggers an alert when the expiry crosses configurable thresholds - for example, 30 days, 14 days, and 7 days before expiry - so you have multiple chances to act before anything breaks.
- Fires an immediate alert if the certificate becomes invalid mid-cycle (wrong hostname, broken chain, revoked cert).
Alerts go out via email, with Slack and webhook support available, so the right person gets notified in whatever channel they actually monitor.
Setting Up an SSL Monitor: Step by Step
Before you add a monitor, it is worth knowing exactly what your certificate looks like right now. You can check any domain from the terminal:
# Check SSL cert expiry for any domain (replace with your domain)
echo | openssl s_client -connect vigilmon.online:443 -servername vigilmon.online 2>/dev/null \
| openssl x509 -noout -dates
You will see output like:
notBefore=Apr 1 00:00:00 2025 GMT
notAfter=Jun 30 23:59:59 2025 GMT
To get the number of days remaining in a single line:
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null \
| openssl x509 -noout -enddate \
| awk -F= '{print $2}' \
| xargs -I{} date -d {} +%s \
| xargs -I{} bash -c 'echo $(( ($1 - $(date +%s)) / 86400 )) days remaining' -- {}
Now, to automate all of this so you never have to remember to run that command:
Step 1. Go to vigilmon.online and create a free account.
Step 2. Click Add Monitor and choose HTTP/HTTPS.
Step 3. Enter your URL (e.g., https://yourdomain.com). Because it is HTTPS, SSL monitoring is enabled automatically.
Step 4. Set your check interval (every 1, 5, or 10 minutes on the free tier) and configure your alert contacts.
Step 5. Save. Vigilmon immediately runs a first check, validates your certificate, and begins tracking the expiry countdown.
That is the entire setup. No agents to install, no cron jobs, no scripts to maintain.
What To Do When You Get an SSL Alert
When Vigilmon sends you a "30 days until expiry" alert, you have plenty of time to act without any urgency. Here is what renewal looks like for the two most common setups.
Let's Encrypt / Certbot
If you manage your own server with Certbot, renewal should already be automated. But verify it:
# Check if the certbot renewal timer is active (systemd)
systemctl status certbot.timer
# Test a dry-run renewal to confirm it will work
certbot renew --dry-run
If the dry run passes, your auto-renewal is healthy and the expiry alert is just a heads-up. If it fails, common causes are:
# Check certbot logs for errors
journalctl -u certbot --since "7 days ago"
# If port 80 is blocked by a firewall, open it temporarily
ufw allow 80
certbot renew
ufw delete allow 80
Cloud-managed certificates (AWS ACM, GCP, Azure)
Cloud certificate managers renew automatically as long as domain validation is still passing. If you get an expiry alert for an ACM certificate, check whether your DNS validation records are still in place:
# List ACM certificates and their renewal status
aws acm list-certificates --query 'CertificateSummaryList[*].[DomainName,Status]' --output table
# Describe a specific cert to see renewal details
aws acm describe-certificate --certificate-arn arn:aws:acm:... \
--query 'Certificate.RenewalSummary'
If auto-renewal is failing, the most common fix is re-adding the CNAME DNS validation record that ACM uses to prove domain ownership.
Combining Uptime + SSL Monitoring in One Dashboard
One underrated advantage of having SSL monitoring alongside uptime monitoring in the same tool is unified incident context. When an alert fires, you immediately know whether the site is down (uptime check failed) or merely approaching a cert expiry (SSL threshold crossed). You do not have to correlate data from two different tools.
In Vigilmon's dashboard, each monitor shows:
- Current uptime percentage over 24h, 7d, and 30d windows
- Response time graph to spot latency spikes
- SSL expiry countdown - days remaining, certificate issuer, and whether the cert chain is valid
- Incident log with timestamps so you can calculate MTTR and report accurately to stakeholders
This gives you a single pane of glass for answering the most common on-call questions: Is the site up? Is the cert okay? When did the last incident start and end?
Free Tier: 10 Monitors Including SSL Checks
Vigilmon's free tier includes 10 monitors with SSL certificate checking built in for every HTTPS endpoint you add. There is no credit card required and no 14-day trial cliff - the free tier is permanent.
For a typical small team or solo developer, 10 monitors covers:
- Your production domain (uptime + SSL)
- Your API subdomain
- Your staging environment
- A few critical third-party dependencies (payment gateway status page, auth provider)
If you need more monitors or faster check intervals, paid plans start at a low monthly rate.
Stop Relying on Calendar Reminders
SSL certificate expiry is not a complex problem. It is a monitoring gap. Every minute your certificate is expired is a minute your users see a security warning and leave. Every staging site you forgot about is a ticking clock that will eventually embarrass someone.
The fix is a one-time five-minute setup that then runs silently in the background, alerting you weeks before you need to act.
Start free at https://vigilmon.online - 10 monitors, SSL expiry tracking included, no credit card required.
Top comments (0)