Monitoring SSL certificate expiry

Last updated: 9 November 2026

An expired certificate means a red warning screen in front of every visitor. For the client, the site is “broken”, even if the server is running perfectly.

With Let’s Encrypt, a certificate lasts 90 days and renews itself. When it works. It is precisely when it stops working that nobody notices.

Why automatic renewal breaks

A scheduled task deleted during a migration or a server update.
A DNS or proxy change that prevents validation.
Port 80 closed by a firewall, while validation needs it.
A domain added to a server without renewal being configured for it.

Checking a date by hand

From a terminal, replace example.com with the domain:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate

The command prints the expiry date. Handy for one site. Impractical for thirty, and people forget.

Alert thresholds

An alert on the day of expiry is useless. We warn at 14 days: enough to fix it without stress, short enough not to alert you about a certificate that will renew itself at 30 days. If your automatic renewal happens 30 days before expiry, an alert at 14 days means it has already failed twice.

What StatOps checks

Each site is checked and the expiry date read. The check runs every 15 minutes, the alert goes out 14 days before expiry, and the certificate status appears in the client’s monthly report. StatOps monitors certificates, not yet the expiry date of domain names.

Frequently asked questions

What should I do when a certificate has expired?

Start the renewal right away (certbot renew on a standard server), reload the web server, then find out why automatic renewal had stopped working, otherwise it will happen again in 90 days.