SSL certificate expiry monitoring
Lampwick reads your SSL certificate every 6 to 12 hours and alerts 14, 7, 3 and 1 days before it expires, and at once when browsers would reject it.
Lampwick reads the SSL certificate of every https:// URL you monitor, every 6 to 12 hours, and alerts your team 14, 7, 3 and 1 days before it expires. When a certificate becomes invalid (expired, issued for another host, or from an unknown issuer) the team hears about it right away. It comes with every uptime monitor, on by default, on every plan.
Why automatic renewal still fails
Let's Encrypt and most hosts renew certificates on their own. Renewal breaks quietly when a DNS record moves, a firewall blocks the validation request, a cron job for certbot stops, or a custom domain on a platform loses its verification. Visitors then see NET::ERR_CERT_DATE_INVALID instead of your site: what that error means and how to fix it.
What you get
| How often | Every 6 to 12 hours, and within a minute after you add a monitor or change its host. |
| What it reads | Expiry date, issuer, the names on the certificate, and whether it is valid for the host against Mozilla's root certificates. |
| Expiry alerts | 14, 7, 3 and 1 days before expiry, each once per certificate. A renewed certificate starts over. |
| Invalid alert | When the certificate expires, names the wrong host or has an unknown issuer. Once, until it is valid again. |
| Where you see it | The SSL tile on the monitor's page, and a badge in the monitor list: SSL invalid, or SSL 9d within 14 days of expiry. |
Alerts go to the whole team by push and e-mail, and to Slack, Discord, Microsoft Teams or a webhook through an alert channel. When an uptime check fails because of the certificate, the down alert says so and no second alert is sent.
Set it up
- Create an account and open Uptime.
- Add a monitor with an
https://URL. The SSL certificate check is already ticked. - Within a minute, the SSL tile on the monitor's page shows the expiry date and issuer.
Each host you want checked needs its own monitor: example.com and api.example.com can have different certificates. The SSL, domain and DNS docs list every setting and error message.
What it doesn't do
- It checks the certificate your server presents on port 443 of the monitored URL. It doesn't scan your other hosts or ports.
- No grade for TLS versions, ciphers or headers, and no certificate transparency log watch.
- An
http://URL has no certificate to check; the tile says None. - If the connection fails before the handshake, the uptime check reports it, not the certificate check.
What it costs
Included with every uptime monitor: 3 on Free, 20 on Pro (€29), 100 on Team (€79), 300 on Business (€199), per team per month. See pricing.
Related
- The same monitor watches your domain registration: domain expiry monitoring.
- Mixed content (an
http://image on anhttpspage) is found by the site crawl. - The five things that take an app offline: how to know when your app is down.
Start free and add your first https:// URL.