Automation
The certificate that renews itself
Reminders at 30, 7 and 1 day catch a renewal job that stopped; the HTTPS monitor fails the first check after expiry.
SSL certificate monitoring
SSL certificate monitoring: expiry, chain and revocation alerts from 300+ locations
HostTracker checks the certificate your server actually presents, from 300+ checkpoints in 158 cities. You get reminders 30, 7 and 1 day before it expires, and an alert when it lapses, stops chaining to a trusted root, no longer covers the hostname or is revoked. A failed check is confirmed from other locations first.
30-day trial · 100 monitors · certificate checks included · no credit card
- Trusted since 2004
- 500,000+ websites monitored
- 300+ checkpoints worldwide
How a certificate check reaches your contacts
Checked on every HTTPS requestEach check of an HTTPS monitor runs a real TLS handshake from the checkpoints you pick among 300+ in 158 cities.
Reminders at 30, 7 and 1 dayA notice before the certificate runs out, and an outage alert if it expires anyway.
Chain, hostname and revocationA certificate monitor checks all three on every run; an HTTPS monitor can be made just as strict.
Three ways HostTracker watches an SSL certificate
Pick by what you already monitor.
AN HTTPS MONITOR WITH CERTIFICATE CHECKS, THROUGH THE API
POST /monitor { "type": "http", "url": "https://example.com", "interval": 60, "locations": { "pools": ["allworld"] }, "settings": { "requireValidChain": true, "checkRevocation": true, "attached": { "sslExp": true } } }
On every check of an HTTPS monitor
Every request to an https:// address runs a full TLS handshake from the checkpoints you pick, and an expired certificate fails it with nothing to switch on. With the stricter TLS rules on, it also fails on a broken chain, a hostname mismatch or a revoked certificate.
Switched on inside a website monitor
It reads the handshake your website monitor already makes: no extra request, no extra monitor. Every 12 hours it takes the newest certificate seen, sends the 30, 7 and 1 day reminders and reports a changed certificate.
As a certificate monitor of its own
For a mail server, a gateway or another port, add a Certificate expiration monitor for host:port. It runs every 6 hours and always checks chain, hostname and revocation. Check a certificate once now
On every run
What each kind of SSL check verifies
The switches are an HTTPS monitor's stricter TLS rules; the pricing table below shows which plans include them.
Check
HTTPS monitor
Inside a website monitor
Certificate monitor
Expiry date
Fails the check once expired
Reminders 30, 7 and 1 day ahead; fails once expired
Reminders 30, 7 and 1 day ahead; fails once expired
Chain to a trusted root
With the valid-chain switch
When the website monitor's switch is on
Every run
Hostname covered
With the valid-chain switch
When the website monitor's switch is on
Every run
Revocation (OCSP or CRL)
With the revocation switch
When the website monitor's switch is on
Every run
TLS 1.2 or newer, cipher of 128 bits or more
With the strong-TLS and weak-cipher switches
When the website monitor's switches are on
Not checked
Certificate changed notice
No
Yes, when the serial number changes
No
Runs from
The checkpoints you pick, at the monitor's interval
The website monitor's own checks, read every 12 hours
Checkpoints HostTracker chooses, every 6 hours
Every result records what was served: expiry and start dates, issuer, serial number, the names covered, and the negotiated protocol and cipher.
47-day certificates
Certificate lifetimes are falling to 47 days
The CA/Browser Forum, where certificate authorities and browser makers set the rules for public TLS certificates, adopted ballot SC-081 in April 2025 (voting closed 11 April 2025). It shortens, in three steps, how long a certificate may be valid and how long a check of domain control may be reused.
| Issued from | Longest certificate validity | Domain validation reused for |
|---|---|---|
| Before 15 March 2026 | 398 days | 398 days |
| 15 March 2026 | 200 days | 200 days |
| 15 March 2027 | 100 days | 100 days |
| 15 March 2029 | 47 days | 10 days |
Source: CA/Browser Forum Baseline Requirements, version 2.3.1, sections 1.2.2, 4.2.1 and 6.3.2, read 1 November 2026. HostTracker is not affiliated with the CA/Browser Forum.
Why it makes monitoring matter more. A 47-day certificate has to be replaced at least eight times a year, and with a 10-day reuse window almost every replacement must prove control of the domain again. Each renewal is another chance for automation to stop quietly: a job that no longer runs, a validation record someone tidied away, a server that never reloaded the new file. From the inside, working and broken automation look the same; a check from outside sees the certificate actually served.
What the reminder ladder means on a 47-day certificate. A reminder fires on the day the certificate has exactly 30, 7 or 1 day left, so on a 47-day certificate the 30-day reminder arrives 17 days after issue, the 7-day one 23 days later and the last one 6 days after that. Whether the first is news depends on your renewal schedule: if your automation renews before 30 days remain, a 30-day reminder means it did not run; if it renews later, expect a 30-day reminder on every certificate and act on the 7-day one. Either way an expired certificate fails the check and alerts like an outage, and inside a website monitor you get a notice each time the certificate changes.
Where certificates break
Six certificates worth a check of their own
Each can fail while the homepage padlock looks fine.
APIs
The endpoint your apps call
Apps and partner integrations cannot click past a warning. An API monitor with the valid-chain switch fails on an untrusted chain or a hostname mismatch first.
Mail
The mail server
A certificate monitor on host:465 or host:993 sees what mail clients see. STARTTLS is not supported.
Ports
Admin panels and gateways
A control panel on 8443 or an API gateway gets a certificate monitor on host:port.
CDN
The origin behind the edge
A CDN presents its own certificate, so check the origin's hostname too: whatever talks to the origin directly sees the origin's.
Agency
Many client sites
Switch the certificate check on inside each client's website monitor: no extra monitors, and the reminders reach the contacts on that site.
After a finding
Reminders, outage alerts and a record of each renewal
An expiring certificate and a failed one are different news, and travel differently.
Before it expires
One notice at 30, 7 and 1 day left, by email, SMS or a messenger such as Telegram. A reminder never places a voice call; calls are kept for outages.
When it fails
An expired, revoked or mis-chained certificate is a failed check. Once confirmed it opens an incident, and each contact is alerted on its own delay, from immediately to 24 hours, by email, SMS, voice call, Slack, Microsoft Teams, Telegram, PagerDuty, webhooks and more.
When it changes
Inside a website monitor, the certificate check sends a notice when the serial number changes, naming the new expiry date and issuer: a renewal you can see, not one you assume.
Plans and prices
What SSL certificate monitoring costs
Certificate checks and the stricter TLS rules are plan features. The figures come from the live plan catalog.
| Complete | Webmaster | Business | |
|---|---|---|---|
| Price | $9 a month or $99 a year | $14 a month or $149 a year | $29 a month or $299 a year |
| Monitors | 10, all on one website and its subdomains | 10 | 25 |
| Fastest check | 1 minute | 5 minutes | 1 minute |
| Certificate expiry checks | Included | Included | Included |
| Stricter TLS rules on HTTPS monitors | Included | Included | Included |
| Revocation check on HTTPS monitors | Included | Not included | Not included |
| Check types | All 14 monitor types | 9 of 14 monitor types (no API, transaction, page speed, server load or SNMP) | 13 of 14 monitor types (no SNMP) |
Every account starts with the 30-day trial: 100 monitors, checks every minute, no credit card. Certificate checks are part of it. Enterprise plans and the full feature lists are on the pricing page.
30-day money-back on your first payment · your price stays while your subscription stays active
Switching services
Bring your website monitors with you
The importer recreates your checks; then switch the certificate check on inside each website monitor.
Export from the service you use now
UptimeRobot, Pingdom, StatusCake, Better Stack, Site24x7 and Uptime Kuma exports are read directly; any other service works through a plain list of URLs.
Paste it into the New monitor panel
HTTP, keyword, ping and port monitors map onto HostTracker checks; anything that has no equivalent is listed with the reason, never dropped silently.
Run both side by side
The 30-day trial fits 100 monitors, so you can compare before you cancel anything.
THE IMPORTER READS
export UptimeRobot Pingdom StatusCake Site24x7 Better Stack Uptime Kuma or URLs https://example.com https://shop.example.com
Start the 30-day trial first (100 monitors, no credit card) and confirm your email - the importer opens once the address is confirmed.
HostTracker is not affiliated with any company named on this page; product names are trademarks of their owners.
Every layer of your stack, monitored
Websites, servers, APIs, certificates. One check type per page, the same locations, alerts and reports behind all of them.
Trusted by teams at
The guide
Running SSL certificate monitoring well
Every chapter opens in place, so the page stays short.
What SSL certificate monitoring is, and why the date is not enough
SSL certificate monitoring (strictly, TLS today) checks from outside, on a schedule, the certificate a server presents. Expiry is the common failure, not the only one: a certificate can fail to chain to a trusted root, miss the hostname or be revoked months before it expires, and browsers block all four alike. HostTracker reads it from the TLS handshake, as served. For the domain registration behind it, see SSL and domain expiration monitoring.
Certificate Transparency logs, and what this monitoring does not do
Certificate authorities record the certificates they issue in public, append-only Certificate Transparency logs (RFC 6962, June 2013). Searching them shows every certificate issued for your domains, including ones you did not request, such as one for a subdomain nobody remembers.
HostTracker does not watch Certificate Transparency logs. It checks the certificate your server presents. The other limits worth knowing:
- No STARTTLS. The handshake starts as soon as the connection opens, so SMTP on 587 or IMAP on 143 needs the implicit-TLS port instead.
- No client certificates. The check validates the server's certificate; it does not run a mutual-TLS handshake.
- A missing intermediate can pass. Like most browsers, the check can fetch an intermediate the server leaves out. OpenSSL and many API clients do not, so install the full chain.
- Fixed reminder days in the dashboard. The 30, 7 and 1 day ladder has no dashboard setting. An HTTPS, API or port monitor accepts its own list of days, certWatchDays, through the monitoring API.
- Revocation depends on the authority. If its OCSP or CRL service cannot be reached, the check does not fail, so a responder outage never becomes your false alarm.
SSL monitoring or an SSL checker?
A checker answers once, when you ask: the SSL certificate checker shows any site's expiry date, issuer, chain and TLS version now, and the certificate decoder reads a PEM certificate you paste. Monitoring answers while you are not looking. When a browser has already shown the warning, the guides on NET::ERR_CERT_DATE_INVALID and "Your connection is not private" walk through the fix.
Setting up SSL certificate monitoring in five steps
- Run the SSL certificate checker on the site to see today's expiry date and chain.
- Add an HTTPS monitor for the site, or open the one you have, and switch on the certificate check inside it.
- Where your plan includes them, turn on the valid-chain and revocation switches for anything public.
- Add a certificate monitor for each TLS endpoint you do not watch for uptime.
- Subscribe more than one contact to the reminders.
Key takeaways
Key takeaways
- HostTracker checks a certificate in three ways: on every check of an HTTPS monitor from the checkpoints you pick among 300+ in 158 cities, as a certificate check inside a website monitor that reads the latest certificate every 12 hours, and as a certificate monitor that runs every 6 hours.
- Expiry reminders go out on the day a certificate has exactly 30, 7 and 1 day left; the dashboard has no setting for those days, and an expired certificate fails the check and alerts like an outage.
- A certificate monitor checks the chain, the hostname and revocation on every run; an HTTPS monitor checks them when its valid-chain and revocation switches are on, on plans that include them.
- Under CA/Browser Forum ballot SC-081 the longest certificate validity is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029; on a 47-day certificate the 30-day reminder arrives 17 days after issue.
- HostTracker does not watch Certificate Transparency logs; every account starts with a 30-day trial of 100 monitors and no credit card.
Frequently Asked Questions
A scheduled check, made from outside, of the certificate a server actually presents, with a warning before it expires and an alert when it fails. HostTracker checks certificates from 300+ checkpoints in 158 cities: on every HTTPS check, inside a website monitor, or with a certificate monitor of its own.
Reminders go out on the day a certificate has exactly 30, 7 and 1 day left. The ladder is fixed and the dashboard has no setting for it; through the monitoring API, an HTTPS, API or port monitor accepts its own reminder days (certWatchDays). If the certificate expires anyway, the next check fails and your contacts get an outage alert.
A certificate monitor checks all three on every run, revocation through the authority's OCSP or CRL service. An HTTPS monitor fails on an expired certificate by default and checks the chain, the hostname and revocation once its stricter TLS rules are on, on plans that include them.
CA/Browser Forum ballot SC-081 (voting closed 11 April 2025) lowers the maximum certificate lifetime to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. That means at least eight renewals a year, each a chance for automation to fail quietly. On a 47-day certificate the 30-day reminder arrives 17 days after issue.
Yes. A certificate monitor takes host:port, assumes 443 when the port is left off and sends the hostname with SNI, so a mail server on 465 or 993 or an admin panel on 8443 is watched the same way. STARTTLS, as on SMTP port 587, is not supported.
No. HostTracker checks the certificate your server presents and does not read Certificate Transparency logs, so it will not tell you about a certificate someone else obtained for your domain. A CT log search answers that question.
Certificate checks are included on Complete, Webmaster and Business and on the 30-day trial. The stricter TLS switches come with Complete, Webmaster and Business. The Free plan does not include certificate checks. Every account starts with a 30-day trial of 100 monitors, no credit card. 30-day money-back on your first payment.
An HTTPS monitor checks from the checkpoints you pick among 300+ in 158 cities; a certificate monitor runs every 6 hours from checkpoints HostTracker chooses. Unless you switch rechecking off, a failed check is re-run from other locations before it counts as an outage.
30-day trial - 100 monitors - no credit card
Know about a certificate before your visitors do
Add the site, switch on the certificate check and choose who gets the reminders.
- Trusted since 2004
- 500,000+ websites monitored
- 300+ checkpoints worldwide
Part of HostTracker's website monitoring software.
30-day trial - no card needed
Start the 30-day trial