Skip to content
SSL certificate & domain watch

SSL certificate monitoring and expiry alerts

Monity checks the certificate, the domain registration and the DNS behind your site on every check. You hear 14 days before a certificate expires, 30 days before the domain does, and the day the nameservers change.

Free plan, no card. Or check a certificate now with the free SSL checker.

  • On the free plan
  • Certificate, domain and DNS
  • Alerts before anything lapses

Three ways a working site goes dark

The certificate, the domain and the DNS, on every check.

An expired certificate replaces your site with a full-page browser warning. An expired domain takes the site and its email with it. Changed nameservers are how a hijack starts. None of them shows on the page beforehand, and all three still happen to well-run sites: a renewal job fails quietly, a card on the registrar account expires, the person who set up auto-renew leaves.

  • Certificate: days left, issuer, host names covered, chain and TLS version
  • Domain: expiry from the registry’s own record (RDAP)
  • DNS: nameservers, mail servers, addresses and CAA records

Why now

Certificates are getting shorter, and the reminder emails are gone.

The CA/Browser Forum has voted to cut the longest a public TLS certificate may last: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. More renewals mean more chances for one to fail without anyone noticing, and Let’s Encrypt stopped sending expiry reminder emails in June 2025. A monitor that checks the live certificate is how you find out in time.

  • Alerts 14 days before the certificate expires, once
  • And 30 days before the domain registration does
  • Both thresholds are yours to change, per task

Runs when the page can’t

It checks the host, so a blocked page visit doesn’t stop it.

The watch opens its own connection to your server rather than reading the page, so it still runs when the page itself is behind a login, a captcha or an anti-bot wall. Pair it with any task you already have, or give each site you look after its own task: agencies watch every client domain this way.

  • Domain expiry read from the registry, at most twice a day
  • DNS read from public resolvers, so you see what visitors see
  • Hosted on a platform domain? Monity says so instead of guessing
Where alerts can go

Alert rules

Eight rules. Five are on from the start.

Expiry rules alert once when the days left drop under the threshold; change rules alert when the value changes from one check to the next. These are the defaults a new task starts with.

SSL certificate & domain watch

Every plan, free included

Options Check the domain registration (RDAP): on · Check DNS (nameservers, MX, addresses, CAA): on

Rule New tasks Default What it catches
Days until the certificate expires On 14 days Automated renewals normally happen 30 days before expiry, so a certificate this close to it is one whose renewal failed.
Certificate invalid, expired or for the wrong host On Once, while it lasts Browsers show a full-page warning instead of the site. Alerts once while it lasts.
Certificate authority changed On Any change The certificate now comes from a different authority. Expected when you switch providers; otherwise worth a look.
Days until the domain registration expires On 30 days From the registry’s own record (RDAP). An expired domain takes the site and its email with it.
Nameservers changed On Any change Expected when you move DNS providers; otherwise it is how a domain hijack starts.
Mail servers changed Off Any change The domain’s MX records changed, so its email goes to different servers.
IP addresses changed Off Any change The host resolves to different addresses. Off by default: CDNs rotate addresses routinely.
Outdated TLS version Off Once, while it lasts The server negotiates TLS 1.1 or older, which browsers refuse and PCI DSS forbids.

The first check records the certificate authority, nameservers and DNS as they are, so nothing alerts on it. A move you planned, such as switching DNS providers, alerts once; that is the record that it happened.

Examples

Ask for it in a sentence. Hear about it before it lapses.

Tell the assistant what to watch, or switch the skill on in a task’s settings. Alerts go to the channels you turn on for the task.

  • Tell me before the SSL certificate on shop.northwind.example expires
    Slack · #ops-alerts
    Days until the certificate expires: 9 days (threshold 14 days). The renewal job had stopped after a server move. Renewed the same morning.
  • Warn me 60 days before coastalcrm.com’s domain registration runs out
    Email · it@coastalcrm.com
    Days until the domain registration expires: 58 days (threshold 60 days). Read from the registry’s RDAP record, not a WHOIS mirror.
  • Alert me if the nameservers for fieldnote.com change
    Microsoft Teams · Infrastructure
    Nameservers changed. The DNS provider move was planned. The alert is the record that it happened.
  • Watch the certificate on app.coastalcrm.com
    Telegram · On-call
    Certificate invalid, expired or for the wrong host: 1. The new load balancer served a certificate for another host name.

Coastal CRM, Northwind and Fieldnote are example companies.

Free tools

Check a certificate now, then stop checking.

The free SSL checker reads a site’s certificate and domain once. Monitoring reads them on every check and tells you before either runs out.

FAQ

Questions about SSL certificate monitoring

What does SSL certificate monitoring check?
On every check of the task, Monity connects to your server and reads the certificate: how many days it has left, who issued it, which host names it covers, whether the chain is complete and which TLS version the server uses. It also reads the domain registration’s expiry from the registry (RDAP) and the domain’s DNS records.
When will I be alerted?
Once when the certificate has fewer than 14 days left, once when the domain registration has fewer than 30, straight away when the certificate is invalid, expired or for the wrong host name, and when the certificate authority or the nameservers change. Mail server, IP address and old TLS version alerts are there to switch on.
Why 14 days?
Automated renewals normally run about 30 days before expiry, so a certificate still within 14 days of expiring is one whose renewal failed. That leaves two weeks to fix it. You can set any number from 1 to 90.
How are certificate lifetimes changing?
The CA/Browser Forum voted in April 2025 (ballot SC-081) to shorten the longest a public TLS certificate may be valid: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Renewals become more frequent, so a failed one turns into an outage sooner.
Can it watch many domains?
Yes: each task watches the host in its address, so give each site its own task. The free plan has 3 tasks; paid plans have more, and business accounts can import many tasks at once.
Does it work if the site blocks bots?
Yes. The watch inspects the host, not the page, so it runs even when the page visit lands on a captcha or an anti-bot wall.
Is it on the free plan?
Yes. The SSL certificate & domain watch is on every plan, including the free plan.

Related

Never learn about an expired certificate from a customer.

Add the SSL certificate & domain watch to a task and Monity tells you 14 days before the certificate expires, and 30 before the domain does.

Start free Talk to us
  • Free plan: 3 tasks, no card
  • 7-day Business trial
  • Every alert channel on every plan
Kamil, Alex and Martyna Median reply under 6 hours

Have a question?

Pricing, security, or scoping - pick a route and you will land in a real person's inbox.

S Talk to sales Pricing and scoping H Get support Help with a monitor D Book a demo 30-minute walkthrough