Certificate expiry monitoring
SSL certificate monitoringthat warns before expiry
Get alerted 7 to 90 days before an SSL certificate expires, and the moment one expires, fails validation or can't be read. Sentinel reads the certificate with every HTTP check, alongside uptime, DNS and domain expiration, so a TLS problem doesn't turn into an outage.
Updated on 2026-11-01 · Included on every plan, Free included · Check a certificate now
Status
valid
Issuer
Let's Encrypt
Valid from
Sep 11, 2026
Valid until
Dec 10, 2026
31 days
Status
valid
Issuer
Cloudflare, Inc.
Valid from
Aug 19, 2026
Valid until
Nov 17, 2026
8 days
Why SSL monitoring
A certificate can fail while your server is perfectly healthy
Your site can be up, your app running and your servers healthy while HTTPS is broken. An expired or invalid certificate brings up browser security warnings, breaks API clients and interrupts webhooks, because nothing can establish a trusted connection.
Sentinel checks the certificate itself, not just whether the server answers. It records the issuer, the expiry date, the TLS protocol and cipher, counts down the days, and alerts you while there's still time to renew.
- Expiry warnings 7 to 90 days ahead, set per monitor
- Alerts on expired, invalid and unreadable certificates
- Issuer, expiry date, TLS protocol and cipher on every monitor
Certificate check · example.com
- Issuer
- Let's Encrypt
- Valid until
- Dec 10, 2026
- Days remaining
- 31
- Warn me
- 14 days before (7 to 90)
- On expiry
- Open incident + alert
Features
Complete SSL visibility
Expiry alerts
Get notified 7, 14, 30, 60 or 90 days before a certificate expires. Set the window per monitor, longer for certificates renewed by hand.
Certificate details
See who issued the certificate and when it expires on every monitor, with the days remaining counted down for you.
Multi-domain coverage
Track certificates across websites, apps and APIs in one place. No per-certificate fees. The SSL check comes with every website monitor.
Alerts where you work
Email, SMS, Slack, Microsoft Teams, Discord, Telegram, PagerDuty and webhooks, so the renewal reminder reaches whoever owns the certificate.
Incident tracking
A certificate entering its warning window, expiring or failing to load opens an incident. It closes on its own once a valid certificate is back.
Bundled with uptime
Certificate facts come back with every HTTP check, from every region the monitor runs in. Switch the SSL check on when you create or edit a website monitor and there's nothing else to set up.
What SSL monitoring does
The facts, in one place
Updated on 2026-11-01. What the SSL check reads, when it warns, how often it runs and who gets it.
- What is checked
- Validity window (not yet valid, valid, expired), days until expiry, issuer, the hostname on the certificate, and the negotiated TLS protocol, cipher and key size. The HTTP check also verifies the chain and hostname on every request, so a broken chain or a certificate for the wrong name fails the check with an SSL certificate error.
- Expiry warning
- 7, 14, 30, 60 or 90 days before expiry, chosen per monitor. New monitors start at 14 days. When the days remaining reach the threshold, an incident opens and the alert goes out.
- Other alerts
- A certificate that has expired, is not yet valid, or cannot be read (a failed handshake or an unparseable certificate) opens an incident at once. The incident closes on its own when a valid certificate is back.
- How often
- Since 2026-10-29, certificate facts come back with every HTTP check, from each region the monitor runs in, at the monitor's check interval. If no HTTP check has reported facts in the last 15 minutes, a standalone TLS handshake runs instead, scheduled every 30 minutes.
- Which monitors
- Any website (HTTP) monitor with an https:// URL. The SSL check is a sub-check you switch on when creating or editing the monitor, with no per-certificate fee.
- Which plans
- Every plan, Free included.
To see what a single check reads, run the free SSL certificate checker on any domain. Setup, the threshold setting and the alert types are in the SSL certificates documentation.
What SSL monitoring catches
Expiration isn't the only way TLS breaks
The expiry date is the obvious failure. It isn't the only certificate problem worth an alert.
Certificates about to expire
The warning arrives when the certificate enters the window you set, early enough to renew without anyone seeing a browser error.
Expired certificates
Once a certificate passes its end date, browsers and API clients refuse to trust it. Sentinel opens an incident the moment it sees that.
Certificates that can't be read
A handshake that fails, a certificate that won't parse, or one that isn't valid yet. Each one opens an incident instead of waiting for the expiry date.
Broken chains and wrong hostnames
A current certificate still fails if the server sends an incomplete chain or the certificate doesn't cover the hostname. Sentinel's uptime check verifies both on every request, so it fails, and is confirmed across regions like any other outage.
Renewals that didn't happen
Let's Encrypt and most hosts renew certificates automatically. Monitoring is the independent check that the automation actually worked this time.
Sentinel checks from outside your network, so you see the certificate your visitors and API clients actually receive. The certificate is one of three dates worth watching. The other two are the domain registration and the DNS records that point the domain at your servers.
SSL vs uptime monitoring
A server can be up while HTTPS is broken
Uptime monitoring checks whether your site responds correctly. SSL monitoring checks whether clients can trust the connection, and how long that trust has left. A web server can answer every request while presenting a certificate that expired last night. From the server's side, it's online. From a visitor's browser, it's broken. That's why Sentinel watches both, on the same monitor.
What is SSL certificate monitoring?
SSL certificate monitoring checks the certificate a website or service presents and watches its validity and expiration date. Sentinel connects to your site, reads the certificate, records the issuer and expiry date, and alerts you when it's about to expire, has expired or can't be read.
How do I check when an SSL certificate expires?
Inspect the site's certificate to see its valid-until date. Sentinel's free SSL checker does a live TLS handshake and shows the expiration date, issuer, negotiated TLS version, cipher and an A-to-F grade, with no account needed. To keep watching the date instead of checking by hand, turn on the SSL check for a monitor.
How far in advance does Sentinel warn me?
You choose per monitor: 7, 14, 30, 60 or 90 days before the certificate expires. New monitors start at 14 days.
Does Let's Encrypt renew certificates automatically?
Usually. Let's Encrypt certificates are renewed by software on your server, hosting platform or CDN. When that automation breaks, nothing tells you until the certificate runs out. SSL monitoring is the independent check that the renewal happened, with a warning while there's still time to fix it.
Can a certificate be valid but still have a problem?
Yes. A certificate inside its validity dates can still fail if the server sends an incomplete chain or the certificate doesn't cover the hostname visitors use. Sentinel's uptime check verifies the chain and hostname on every request, so those problems show up as a failed check with an SSL certificate error.
Is SSL expiration the same as domain expiration?
No. The certificate and the domain registration expire separately. A certificate typically renews every few months, while a domain can be registered for years. Sentinel monitors them as separate checks, so a valid certificate doesn't hide a lapsing domain.
Does SSL monitoring replace uptime monitoring?
No. Uptime monitoring checks whether your site responds correctly. SSL monitoring checks whether clients can trust the connection and warns you before the certificate runs out. Run both on the same monitor.
Can I monitor many certificates?
Yes. Turn on the SSL check for each website you monitor, across sites, apps, APIs, teams and client projects, with no per-certificate fees.
How will I be notified?
Through any channel you've set up: email, SMS, Slack, Microsoft Teams, Discord, Telegram, PagerDuty or webhooks.
Is SSL monitoring on the free plan?
Yes. The SSL check is on every plan, Free included, along with uptime, DNS, domain expiration and keyword checks.
Know before a certificate becomes a problem.
Monitor SSL certificates alongside uptime, DNS and domain expiration.
No card for the free plan · 14-day trial on paid plans · Cancel anytime