# SSL certificate expiry monitoring

> Lampwick reads your SSL certificate every 6 to 12 hours and alerts 14, 7, 3 and 1 days before it expires, and at once when browsers would reject it.

Lampwick reads the SSL certificate of every `https://` URL you monitor, every 6 to 12 hours, and alerts your team 14, 7, 3 and 1 days before it expires. When a certificate becomes invalid (expired, issued for another host, or from an unknown issuer) the team hears about it right away. It comes with every [uptime monitor](/features/uptime-monitoring/), on by default, on every plan.

## Why automatic renewal still fails

Let's Encrypt and most hosts renew certificates on their own. Renewal breaks quietly when a DNS record moves, a firewall blocks the validation request, a cron job for `certbot` stops, or a custom domain on a platform loses its verification. Visitors then see `NET::ERR_CERT_DATE_INVALID` instead of your site: [what that error means and how to fix it](/errors/err-cert-date-invalid/).
## What you get

| | |
|---|---|
| How often | Every 6 to 12 hours, and within a minute after you add a monitor or change its host. |
| What it reads | Expiry date, issuer, the names on the certificate, and whether it is valid for the host against Mozilla's root certificates. |
| Expiry alerts | 14, 7, 3 and 1 days before expiry, each once per certificate. A renewed certificate starts over. |
| Invalid alert | When the certificate expires, names the wrong host or has an unknown issuer. Once, until it is valid again. |
| Where you see it | The **SSL** tile on the monitor's page, and a badge in the monitor list: **SSL invalid**, or **SSL 9d** within 14 days of expiry. |

Alerts go to the whole team by push and e-mail, and to Slack, Discord, Microsoft Teams or a webhook through an [alert channel](/docs/alerts/#alert-channels). When an uptime check fails because of the certificate, the down alert says so and no second alert is sent.

## Set it up

1. [Create an account](https://app.lampwick.dev/signup) and open **Uptime**.
2. Add a monitor with an `https://` URL. The **SSL certificate** check is already ticked.
3. Within a minute, the **SSL** tile on the monitor's page shows the expiry date and issuer.

Each host you want checked needs its own monitor: `example.com` and `api.example.com` can have different certificates. The [SSL, domain and DNS docs](/docs/host-checks/) list every setting and error message.

## What it doesn't do

- It checks the certificate your server presents on port 443 of the monitored URL. It doesn't scan your other hosts or ports.
- No grade for TLS versions, ciphers or headers, and no certificate transparency log watch.
- An `http://` URL has no certificate to check; the tile says **None**.
- If the connection fails before the handshake, the uptime check reports it, not the certificate check.

## What it costs

Included with every uptime monitor: 3 on Free, 20 on Pro (€29), 100 on Team (€79), 300 on Business (€199), per team per month. See [pricing](/#pricing).

## Related

- The same monitor watches your domain registration: [domain expiry monitoring](/features/domain-monitoring/).
- Mixed content (an `http://` image on an `https` page) is found by the [site crawl](/features/broken-link-checker/).
- The five things that take an app offline: [how to know when your app is down](/guides/know-when-your-app-is-down/#the-ssl-certificate-expired).

[Start free](https://app.lampwick.dev/signup) and add your first `https://` URL.