SSL certificate and domain expiry monitoring

An expired certificate or a forgotten domain takes a site down as surely as a crashed server, and both are known weeks ahead. Every Website and API Monitor reads its certificate and asks the registry when its domain expires, and tells you before either one does. There is nothing to set up: add the Monitor, and both Checks come with it.

The certificate

The Certificate Check reads your certificate a few times a day. It warns 30, 14 and 7 days before the certificate expires, and fails when it has expired or browsers would stop trusting it: it is self-signed, its chain is not trusted, it was issued for another name, or it is not valid yet.

When a certificate does expire, your visitors cannot reach the site either, so you hear it as an outage: the alert says the Monitor is down, and that its certificate expired.

The domain

The Domain Check asks the registry once a day when your domain registration expires. It warns 30 and 7 days before the domain expires, and fails once the date has passed. It asks about the domain you registered, so for shop.example.co.uk it asks about example.co.uk.

A registry that is slow or out of service never opens an Incident on its own. When it cannot be read for a while, you get one warning that says so.

Warnings come once, in the daily digest

Each warning is said once, and arrives in the daily digest, so a certificate that has weeks left never wakes anyone. When you renew, the expiry date moves on and the warnings start again for the new date.

The Certificate Check, in the Docs

Questions

Do I need a separate Monitor for the certificate?

No. Every Website and API Monitor whose address starts with https reads its certificate.

Does an expiring certificate count against my uptime?

No. A warning never counts against your uptime and never shows on your Status page. Only the site being down does.

Which registries can it read?

Most registries publish when their domains expire in a form we can read. Some do not. When yours does not, the Monitor’s Checks card says the Domain Check is not available for it.

What if the certificate renews on its own?

Then the warnings stop. Each time we read the certificate, we see the new expiry date, and warn about that one.

The Domain Check, in the Docs