Certificates break on a schedule, which makes them easy to monitor and easy to forget. Hyperping checks the certificate of every HTTPS monitor once a day, on every plan including Free: expiry, hostname, chain, trust, revocation, TLS version, and signature strength. You choose when the first expiry alert goes out, from 1 to 90 days ahead, with reminders after it, and the reminders stop as soon as the certificate is renewed.
How SSL certificates work
When a client connects over HTTPS, the server sends its certificate during the TLS handshake. The client checks that the certificate covers the hostname it asked for, that it's within its validity dates, and that it chains up to a certificate authority (CA) it trusts, through one or more intermediate certificates. If all three hold, the two sides agree on encryption keys and the request goes through. If not, browsers show a full-page warning and most API clients refuse to connect.
How certificates break
- Expiry. Public certificates have been valid for at most 200 days since March 2026, Let's Encrypt certificates for 90, and automated renewal fails without warning: an expired API token, a DNS change, a full disk.
- An incomplete chain. The server doesn't send its intermediate certificates. Chrome often repairs this, while curl, Android, and API clients fail.
- A hostname mismatch, such as a new subdomain behind a load balancer serving another domain's certificate.
- Revocation, after a key leak or a mis-issuance.
- Outdated TLS. Current browsers refuse servers that only offer TLS 1.0 or 1.1.
- Self-signed or private-CA certificates reaching public clients that don't trust them.
SSL vs TLS
SSL is the old protocol, replaced by TLS in 1999, and every version of SSL is now disabled in browsers. The name stuck: "SSL certificate" and "TLS certificate" mean the same file. The protocol actually in use today is TLS 1.2 or TLS 1.3.
How to monitor SSL certificates with Hyperping
- Create an HTTPS monitor for each hostname. SSL monitoring is included, with no extra setup.
- In the monitor's Notifications tab, choose when the first expiry alert goes out: 1, 3, 7, 15, 30, 60, or 90 days before expiry.
- Keep reminders on. With a 30-day threshold, alerts go out at 30, 15, 7, 3, and 1 days.
- Route SSL alerts to a chat channel. PagerDuty and Opsgenie are only paged in the last 24 hours, so nobody is woken up a month early.
The same monitors warn before the domain registration itself expires, read from the registry. See SSL and domain expiry monitoring.
FAQ
What happens when an SSL certificate expires?
Browsers show a security warning that most visitors won't click through, and API clients, webhooks, and mobile apps fail to connect at all. The site is effectively down until the certificate is replaced.
How long is an SSL certificate valid?
200 days at most for public certificates issued since March 2026. The CA/Browser Forum's schedule lowers the limit to 100 days in March 2027 and 47 days in March 2029. Let's Encrypt certificates last 90 days.
How far ahead should I be alerted?
14 to 30 days for manually renewed certificates, 7 days for automated ones. An automated renewal that hasn't happened a week before expiry is broken, and a week is enough to fix it.