Setting Up SSL Certificate Expiry Monitoring

An expired SSL certificate is not just a technical glitch — it's a full-blown outage. The site becomes inaccessible: browsers display 'Your connection is not private', SEO rankings drop, and customer trust evaporates. One of our clients lost 150,000 rubles in a single day of downtime because their certificate expired and Let's Encrypt auto-renewal failed due to a DNS error. Monitoring certificate expiry is one of the simplest yet most effective tasks with high impact on availability. Setup takes from 30 minutes to one day and prevents catastrophic consequences.

Why track SSL certificates?

Even if you use automatic renewal via Let's Encrypt, the automation sometimes breaks. Causes: DNS errors, ACME server unreachability, write permission issues. If you don't monitor, you'll only find out from users. In a commercial environment, every hour of downtime means direct losses. We set up monitoring that alerts the team 30, 14, 7, and 1 day before expiry.

Which certificates should be monitored?

• Primary domain (example.com)
• All subdomains (if not using wildcard *.example.com)
• Intermediate certificates in the CA chain — their expiry is equally critical
• Certificates for internal services: APIs, admin panels, DevOps tools

Setting up SSL monitoring in one day

We use a combination of methods: Prometheus + Blackbox Exporter for open-source stacks, Python scripts for custom scenarios, and Uptime Robot for redundancy.

Prometheus Blackbox Exporter

# blackbox.yml modules: https_check: prober: http timeout: 15s http: valid_status_codes: [] method: HEAD tls_config: insecure_skip_verify: false fail_if_ssl: false fail_if_not_ssl: true 

# prometheus.yml scrape config scrape_configs: - job_name: 'ssl_certificate_check' metrics_path: /probe params: module: [https_check] static_configs: - targets: - https://example.com - https://api.example.com - https://admin.example.com relabel_configs: - source_labels: [__address__] target_label: __param_target - source_labels: [__param_target] target_label: instance - target_label: __address__ replacement: blackbox-exporter:9115 

Alert in Prometheus:

- alert: SSLCertificateExpiringSoon expr: probe_ssl_earliest_cert_expiry - time() < 30 * 24 * 3600 labels: severity: warning annotations: summary: "SSL cert on {{ $labels.instance }} expires in {{ $value | humanizeDuration }}" - alert: SSLCertificateExpiryCritical expr: probe_ssl_earliest_cert_expiry - time() < 7 * 24 * 3600 labels: severity: critical annotations: summary: "SSL cert on {{ $labels.instance }} expires in {{ $value | humanizeDuration }}!" 

Python script for monitoring

import ssl import socket from datetime import datetime, timezone def check_ssl_expiry(hostname: str, port: int = 443) -> dict: context = ssl.create_default_context() with socket.create_connection((hostname, port), timeout=10) as sock: with context.wrap_socket(sock, server_hostname=hostname) as ssock: cert = ssock.getpeercert() expiry_str = cert['notAfter'] expiry_date = datetime.strptime(expiry_str, '%b %d %H:%M:%S %Y %Z') expiry_date = expiry_date.replace(tzinfo=timezone.utc) days_remaining = (expiry_date - datetime.now(timezone.utc)).days return { 'hostname': hostname, 'expires_at': expiry_date.isoformat(), 'days_remaining': days_remaining, 'issuer': dict(x[0] for x in cert['issuer']), 'subject': dict(x[0] for x in cert['subject']) } 

The script is easy to run on a schedule via cron or AWS Lambda. We use it for services that shouldn't be exposed to the internet.

External services: Uptime Robot, Better Uptime

The simplest option — external services. Uptime Robot (free plan) checks SSL and sends notifications 30, 7, and 1 day before expiry. Better Uptime and StatusCake work similarly. Setup takes 30 minutes. It's a great complement to Prometheus monitoring for redundancy.

Comparison of methods and alert thresholds

Alert thresholds:

Common mistakes in SSL monitoring setup

• Ignoring wildcard certificates: if you use *.example.com and subdomains are added dynamically, monitor each one.
• Checking only port 443: the certificate might be valid on 443 but not on 8443.
• No alerts for intermediate certificates: expiration of a CA certificate is equally critical.
• Too infrequent checks: once a week is not enough; once daily is better.

Automating renewal with Certbot and ACM

If you use Let's Encrypt + Certbot, manual renewal isn't needed. But monitoring is still necessary — automation sometimes fails.

# Check certbot timer status systemctl status certbot.timer # Dry run without actual renewal certbot renew --dry-run 

Certbot renews certificates when less than 30 days remain. Monitoring triggers at < 30 days — meaning automation didn't fire in time.

For certificates managed via AWS Certificate Manager, you can set up a CloudWatch Alarm on the DaysToExpiry metric. More details in the AWS documentation.

How to choose a monitoring method?

If you already have a Prometheus stack — Blackbox Exporter gives maximum customization. When you need to quickly check a couple of domains — a Python script will suffice. For redundancy or if you lack access to internal infrastructure — an external service. We help you select the optimal option during a free consultation.

What the setup process includes

When you order the 'SSL monitoring setup' service, we perform:

• Audit of current certificates and trust chains
• Selection of the optimal tool (Prometheus/Python/external service) for your stack
• Deployment and configuration of monitoring (with code in repository)
• Alert setup with specified channels (email, Telegram, Slack)
• Documentation of the process and access transfer
• Post-launch support

Setup timelines

• Blackbox Exporter + Prometheus alerts — 0.5-1 day
• Python script + scheduled lambda/cron — 0.5 day
• External service (Uptime Robot) — 30 minutes

Timelines vary depending on the number of monitored domains and infrastructure complexity. We evaluate the project for free and provide an accurate estimate.

We have years of experience with monitoring and have set up SSL alerts for 50+ projects of varying scale — from landing pages to high-load SaaS. Contact us for a free assessment of your infrastructure. Order SSL monitoring setup and forget about certificate issues.

SSL/TLS on Wikipedia