Certificate monitoring, for people who manage other people's sites
Certificates mostly renew themselves. The outage you get is the renewal that stopped working months ago and told nobody, on the one site you were not thinking about.
If you came for a single date on a single name, you do not need any of this: the free certificate checker reads it in a second, with the chain and the covered names. This page is about the two hundred you cannot check by hand.
The four readings, and why the first is not the date
Every one of these comes with the check that is already watching the page, on the same pass. There is no certificate product to buy and no per-certificate line on the invoice, because it is not a separate thing: it is part of reading what a site is actually serving.
The renewal that is not happening
Days remaining, read on a live handshake rather than taken from a cache. The alert fires at fifteen days, which is late enough that an automatic renewal has already failed several times and early enough that a certificate authority can still answer.
In the engine source: src/Check/Ssl.php
The chain the server does not send
A server that presents only its own certificate, without the intermediate, works in desktop browsers and fails on Android, on Java, on curl and on most API clients. It is the defect that gets reported as "it works on my machine", and it is invisible from the machine of whoever deployed it.
In the engine source: src/Check/Ssl.php
The name the certificate does not cover
Wildcards cover one label and not two, so a certificate for *.example.com covers www.example.com and not a.www.example.com. A site that answers both with and without www needs both names, and the missing one only breaks for the visitors who type it.
In the engine source: src/Check/Ssl.php
The domain name behind it
An expired domain looks exactly like a broken certificate and is repaired somewhere else entirely, at a registrar that cannot be rushed. The expiry date is read from the public registry, so the two dates sit side by side instead of being confused for each other.
In the engine source: src/Check/DomainExpiry.php
What the others cover, including where they cover more
| Certificate question | Typical paid monitoring | UptimeEZ |
|---|---|---|
| Expiry date and days remaining | Yes, everywhere | Yes |
| Incomplete chain, spelled out | Rarely, and rarely with a fix | Advantage: UptimeEZ. Yes, with the cause and the first move |
| Name coverage, wildcards included | Sometimes | Advantage: UptimeEZ. Yes |
| Domain name expiry, next to the certificate | Usually a separate product | Advantage: UptimeEZ. Same pass, same screen |
| Cost per site once you pass a hundred | Per-monitor pricing | Advantage: UptimeEZ. One price, unlimited monitors |
| Certificate alerts without paying anything | Advantage: the other tools. StatusCake covers this on its free tier | Free only if you host the engine yourself |
| Checked from several regions | Advantage: the other tools. Several probe locations | One location, ours |
Two rows go the other way. The first matters if you want certificate alerts for nothing and do not want to host anything: that is a real answer, and it is not ours.
The row about hosting it yourself has a page: what you pay for, and what you do not. The row about the other tools has seven: all of them in one table, StatusCake included.
The same pass reads more than the certificate: what changed on the page itself, and if the sites belong to clients, a read-only link per client.
Questions people actually ask
Is certificate monitoring not solved by Let's Encrypt renewing automatically?
It solves the renewal, not the failure of the renewal. The interesting outage is never a certificate nobody tried to renew: it is a cron job that stopped three months ago, a DNS challenge that broke when the zone moved, or a renewal that works on the server that no longer serves the site. All three look identical from outside, and all three show up as a number that stops going back up.
What does watching the domain name expiry add?
It separates two outages that look the same and are repaired in completely different places. An expired domain gives visitors a certificate error, a DNS failure, or a parking page, depending on the registrar. Someone who only watches certificates spends the first hour on the wrong problem, and the registrar is the one party that cannot be rushed.
How many days of warning do you get?
The alert fires at fifteen days and repeats, and the threshold is mechanical rather than cautious: a certificate that renews automatically has had several attempts by fifteen days, so anything unrenewed by then is a renewal that is not happening. Thirty days produces noise nobody reads, and three leaves no time for a certificate authority to answer.
Does it catch a certificate that is valid but wrong?
Yes, and that is the case a date-only check misses. A certificate can be months from expiry and still not cover the name visitors use, which is what happens when a wildcard covers www and the site also answers without it. The same reading catches a server sending only its own certificate without the intermediate, which breaks Android and most API clients while looking perfect in a desktop browser.
Do I need one monitor per certificate?
No. The certificate and domain readings come with the check that is already watching the page, so a site you already monitor is already covered. That is why there is no per-certificate price here: it is not a separate product, it is one of the things a single check looks at.
The certificate that breaks is on the site you forgot
Not the one you check. One price, every site you manage, and the certificate reading comes with the check that is already running.