SSL Certificate Expiry: How to Never Get Caught Offline
An expired certificate can take a healthy site down in an instant. Here is how to make sure it never happens to you.
An expired TLS certificate makes browsers show a full-page warning, taking a healthy site offline instantly. Because the expiry date is known in advance, automate renewal, independently monitor the actual expiry as a backstop, and track every domain, subdomain, and forgotten endpoint with weeks of warning.
A silent, avoidable outage
When a TLS certificate expires, browsers stop trusting the site and show a full page warning. To a visitor, that looks exactly like being hacked. The service is running perfectly, but nobody can use it.
The frustrating part is that this outage is completely predictable. The expiry date is known in advance, which means it should never surprise you.
Keep reading: How to Choose an Uptime Check Interval That Actually Catches Outages, Status Page Best Practices That Reduce Support Tickets, Uptime vs Response Time: What to Monitor and Why Both Matter. See how PingCrumb helps you uptime monitoring and hosted status pages.
Automate renewal, but verify it
Automatic renewal, through a provider or a tool like the ACME protocol, is the right default. But automation fails quietly. A renewal hook that breaks after a config change will not tell you until the certificate lapses.
So automate renewal, and then monitor the actual expiry date independently, as a backstop.
Get warned with room to act
Track the certificate expiry on every domain and subdomain, and get a reminder well before the date, not the morning of. Two weeks of warning gives you time to fix a broken renewal calmly instead of during an incident.
Do not forget the edges
The certificates that lapse are usually the forgotten ones: an old subdomain, an internal tool, an API endpoint. Inventory every certificate you rely on and monitor them all, so the one you forgot about does not become tomorrow's outage. Related: How should a small team monitor third-party vendors that can take its app offline?
- An expired certificate looks like a full outage to users
- It is completely predictable, so it should never surprise you
- Automate renewal and independently monitor the expiry date
- Track every domain, subdomain, and forgotten endpoint
Julien Jimenez
Julien Jimenez is an independent software builder based in Paris. He designs, ships, and operates focused SaaS products for small businesses and independent professionals. Read the full author page.
Frequently asked questions
Why monitor certificate expiry if renewal is automated?
Automation fails quietly. A renewal hook that breaks after a config change gives no warning until the certificate lapses, so monitoring the actual expiry date independently is the backstop that catches it.
Which certificates are most likely to expire unnoticed?
The forgotten ones: an old subdomain, an internal tool, or a rarely touched API endpoint. Inventory every certificate you rely on and monitor them all, not just the main site.
Know before your customers do
Uptime monitoring and hosted status pages. PingCrumb is built to help you put this into practice.
Start monitoringMore from the PingCrumb blog
How to Choose an Uptime Check Interval That Actually Catches Outages
Status Page Best Practices That Reduce Support Tickets
Uptime vs Response Time: What to Monitor and Why Both Matter
Get the PingCrumb playbook
Practical guides on uptime monitoring, straight to your inbox as we publish them. No spam, unsubscribe any time.