How to Monitor SSL Certificate Expiry
Check certificate dates and trust, then verify renewal before the next deadline.
Login2Cloud product team · Published 2026-09-27
Certificate expiry is not domain expiry
An SSL/TLS certificate has a validity period used during encrypted connections. A domain registration has a separate renewal date held by the registrar or registry. Renewing one does not renew the other. Use an SSL check for the certificate presented by the service and a domain-registration check for the registration deadline.
Inspect what the endpoint actually serves
Check the hostname customers use. A load balancer, CDN or alternate hostname may serve a different certificate from the one on your origin server. Verify hostname match and trust as well as the expiration date. A recently issued certificate is not useful if the endpoint is still serving the old one.
Configure warnings before the deadline
Login2Cloud certificate warnings progress through 30, 14, 7, 3 and 1 day thresholds, deduplicated for the same certificate expiry and threshold. Send them to people who can renew or repair deployment. Do not wait for an expiry warning to become an availability incident.
Verify automated renewal
An automated renewal job can fail because of DNS changes, challenge routing, permissions or deployment steps. Check its own logs and consider a success heartbeat. After renewal, run the SSL checker again and confirm the served expiry moved forward. Check each important hostname rather than assuming a wildcard covers everything.
Handle failed checks honestly
A timeout or blocked network path may prevent certificate inspection. Unavailable expiry data is not proof that the certificate is valid or expired. Investigate the connection result, compare from a trusted client, and keep the unresolved state visible until a real certificate can be inspected.
Common questions
Will monitoring renew my certificate?
No. It detects and reports relevant conditions; renewal remains your responsibility.
Can a certificate be unexpired but invalid?
Yes. Hostname mismatch, trust-chain problems and other validation failures can affect an unexpired certificate.