You manage 30 client websites. One SSL certificate expires on a Tuesday. By Wednesday morning the client is calling, their visitors are seeing a red "NOT SECURE" warning, and their checkout page is blocked entirely. You had no idea it was coming.
This is the core problem with SSL certificate monitoring at scale. One domain? You can set a calendar reminder. Twenty or thirty? The math stops working. Certs expire on different dates, issued by different providers, on different hosting accounts. Something always slips.
Here's how to get it under control — for every domain you manage.
Why SSL Certificates Keep Expiring
SSL certificates have a built-in expiry date. Before 2020 they lasted up to 3 years. Now the maximum is 398 days — just over 13 months. Google and Apple forced the change to keep certificates fresh and revocable.
That means every domain you manage needs its cert renewed at least once a year. Often more frequently if you're using 90-day Let's Encrypt certificates, which are the default for most cPanel-based hosting and many cloud platforms.
The common failure modes are predictable:
- Auto-renewal was never set up — someone manually issued the cert and forgot to automate it
- Auto-renewal broke silently — the certbot cron job failed after a server update, nobody noticed
- Hosting migration — the cert renewed on the old server, not the new one
- CDN/proxy misconfiguration — the cert at the origin renewed fine but the edge cert (Cloudflare, Fastly) did not
- Wildcard cert covers some subdomains, misses others — *.example.com doesn't cover example.com itself
When you're managing one domain, you catch these. When you're managing many, they hide.
What an Expired SSL Actually Costs
The browser warning is the visible part. The damage underneath is worse.
Immediate traffic loss
Chrome shows a full red interstitial page — "Your connection is not private." Most visitors leave immediately. On mobile it's even harder to bypass. Conversion rates drop to near zero for any site requiring a login or payment.
Email deliverability
If the domain's mail server cert also expires, outbound email starts failing STARTTLS checks. Some mail servers reject the connection. Your client's emails bounce or get silently dropped.
SEO damage
Google's crawler detects certificate errors. If the site stays down for more than a few days, pages start dropping from the index. Rankings built over years can erode in weeks. Recovery takes longer than the outage did.
For agencies, there's also the client relationship cost. An expired SSL on a client's site looks like negligence — even if the client managed their own hosting. You're the web people. They expect you to know.
How to Monitor SSL Certificates Across Multiple Domains
The right approach depends on how many domains you're managing and how much control you have over them.
Option 1: Manual checks (doesn't scale)
You can check any domain's SSL expiry in a browser by clicking the padlock → "Certificate" → checking the "Valid until" date. This works for one or two domains. It's completely unworkable at 20+.
Option 2: Command-line SSL checks (for technical teams)
For domains you control directly, this OpenSSL command shows the expiry date:
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null \ | openssl x509 -noout -dates
You can script this across a list of domains. But you still have to run it, parse the output, and decide what "30 days away" means for your team. It's error-prone and doesn't alert you automatically.
Option 3: Automated SSL certificate monitoring (what agencies actually use)
An automated monitoring tool checks each domain's SSL certificate on a schedule — daily is standard — and sends you an alert when expiry is approaching or when the cert is already invalid.
The right tool should give you:
- Alerts at 30, 14, and 7 days before expiry — enough lead time to act without being noisy
- Instant alerts if the cert is already expired or invalid
- Coverage for all domains in one dashboard — not one tool per client
- Alerts that go to your team, not just a single email
Preventing SSL Expiry Permanently
Monitoring tells you when something is about to go wrong. Prevention stops it going wrong in the first place. You need both.
Standardise on auto-renewing certificates
Let's Encrypt via certbot or ACME is free and auto-renews by design. Most modern hosts (cPanel with AutoSSL, Cloudflare, AWS Certificate Manager) handle this automatically. Where you have a choice, pick the provider that handles its own renewals.
Verify auto-renewal is actually working
Auto-renewal is only reliable if someone checks that it's running. The cron job that runs certbot renew can fail silently after a system update. Check your certbot logs every few months, or — better — let your SSL monitoring tool confirm the cert was actually renewed.
An automated monitor will catch a cert that failed to renew even though auto-renewal was supposed to handle it. That's the gap that causes most agency incidents.
Build a domain and SSL inventory
Keep a central record of every domain you manage, its registrar, its hosting provider, who controls the DNS, and when its SSL cert expires. A spreadsheet works at small scale. A monitoring dashboard works better as you grow.
This connects directly to domain expiry monitoring — the same discipline applies. The domains and SSL certs that cause the most damage are almost always the ones nobody was watching.
Set up team-level alerts
Alerts sent to one person are a single point of failure. If that person is on holiday, ill, or has left the company — nobody sees the warning. Route SSL alerts to a shared inbox or a team Slack channel so at least one person always catches it.
Audit quarterly
Once a quarter, pull up your full domain and SSL inventory and confirm everything looks right. Expiry dates should be well in the future. Auto-renewal should be enabled. Nothing should have been quietly misconfigured during a server migration.
The same quarterly audit should cover what to do if an SSL cert has already expired — make sure your team knows the fix before they need it under pressure.
| Certificate type | Validity period | Auto-renewal available | When to alert |
|---|---|---|---|
| Let's Encrypt | 90 days | Yes (certbot/ACME) | 30 days before expiry |
| Paid DV cert (e.g. Sectigo) | 1 year | Sometimes | 60 days before expiry |
| OV/EV cert | 1 year | Rarely | 90 days before expiry |
| Wildcard cert | 1 year | Sometimes | 90 days before expiry |
| Cloudflare / AWS ACM | 1 year | Yes (automatic) | Monitor anyway — config can break |