Guide
SSL certificate expiry monitoring
SSL certificate expiry monitoring is the practice of noticing not-after before clients do. Certwatch takes those dates from Certificate Transparency, keeps them on an account, and can alert a paid plan. The public checker is the one-page version of the same dates.
The date that matters
Not-after is the moment a certificate stops being valid in time. Not-before is when it starts. Days until expiry is the gap between now and not-after, and it is the column the checker computes for each row. A certificate that expires today is already an incident for any host still serving it. A certificate with months left is inventory, not an alarm. Monitoring is the decision to look at that gap on a schedule instead of when a browser shows an error.
The source of the date matters. A date from a log is the expiry of an issued certificate. A date from a handshake is the expiry of the certificate a host presented. They match when the issued certificate is the one deployed. They diverge when a renewal was logged and not deployed, or when the host is serving something the logs do not have. Certwatch shows the log date in the inventory and the checker. It shows the served date only on an endpoint page.
How the inventory highlights expiry
Stored certificates are counted as already expired, expiring within 7 days, within 30 days, between 31 and 90 days, and later. Urgent highlighting covers expired rows and rows inside 7 days. Soon highlighting covers the rest of the 30-day window. Filters let you cut the table to 7, 14, 30, 60, or 90 days, and you can search and limit to one domain. CSV export uses the same fields, with a prefix on cells that would otherwise look like spreadsheet formulas.
Rows are not deleted on the expiry date. A certificate that has expired stays, so you can see that it existed. What you often cannot see is a certificate that was already dead before the first successful log read. Plan the first refresh as a start, not as an archive of every certificate the domain ever had. Later refreshes add what the source returns next, one page per queued message.
What the public checker covers
The checker is for a domain you type in, not for a portfolio. It validates the name strictly, fetches one page if the result is not cached, and renders issuer, names, both dates, days until expiry, and the upcoming list. At most 40 certificates are shown. If the source had another page, the result says so and points you at an account, which is where further pages belong. Caching lasts about a day. The per-domain page asks crawlers not to index it, so it is not a generated doorway, and its canonical URL is the checker itself.
Nothing in that flow contacts the domain DNS or port. A timeout talking to the log source becomes an unavailable page, not a guess. A rate limit or the daily lookup cap becomes a busy page with HTTP 429 and no upstream call. Signing up does not bypass that public cap for anonymous lookups. An account uses the monitoring path, which has its own caps and its own stored rows.
When to add an alert
If you open the checker once, you have a snapshot. If the domain matters next month, put it on an account so the snapshot is replaced by a stored inventory. If a person should be told without opening the site, use Pro or Team email at 30, 14, 7, and 1 days, and on expiry. If a channel should be told, use Team and a Slack, Teams, Discord, or generic webhook. Free does not send those messages. There is no API key to poll the dates yourself.
Add an endpoint when the cost of serving the old certificate is the actual risk. The probe is once a day on Pro and Team, and a handful of manual checks on Free. It refuses private addresses. It will not notice an outage that still presents a valid certificate, because it is not an uptime check. Pair it with whatever you already use to see that the site responds, and use Certwatch for the certificates.
A reasonable weekly pass, once the domain is monitored, is the upcoming list, then any endpoint that says a renewal is not deployed, then the export if someone outside the account needs the table. The checker remains useful for a domain you do not monitor yet, or for a name a customer asks about. It is not a substitute for the alert when the person who needs it is not looking at the page.
Questions
Which expiry date does the checker use?
Not-after from the public log page, shown as days until expiry. It is not the certificate your server presents unless you later add an endpoint.
Do expired certificates disappear?
Not after Certwatch has stored them. They stay and are highlighted. Certificates that expired before the first read may never appear.
When are expiry alerts included?
Email alerts are on Pro and Team. Slack and other webhooks are on Team. The free checker and the free plan do not send alerts.
Look up a domain or start monitoring
The public checker reads one page of Certificate Transparency and does not connect to the domain. An account keeps the inventory. Alerts, when you want them, start on a paid plan.
Check a certificate Create an account
See pricing for what Free, Pro, and Team include. The mozilla.org demo is logs only and is not affiliated with Mozilla. Related: Certificate expiry monitoring · Slack alerts · SSL monitoring for small teams.