Certificates don't fail gracefully. There's no slow degradation, no warning email from the CA a week out that anyone actually reads. One day it's valid, the next day every visitor to that site gets a full-page browser warning that says, in red, "Your connection is not private." For a client site, that's the kind of thing that gets forwarded to you within minutes.
The frustrating part is that cert expiration is completely predictable. Certs don't fail randomly like a server going down. They expire on a known date, usually 90 days out for Let's Encrypt or up to a year for a paid cert. The failure isn't the expiration itself, it's that nobody's watching the calendar across every domain you're responsible for.
Why this slips through
A few ways it happens even on teams that know better:
- Auto-renewal silently breaks. Let's Encrypt renews automatically until it doesn't — a DNS change, an expired ACME challenge path, a server migration that didn't carry the renewal cron job with it. The cert was "on autopilot" until the autopilot stopped working, with nothing telling you it stopped.
- Manual certs get forgotten. Paid certs bought once a year don't auto-renew at all. If the person who bought it left, or it's not on anyone's calendar, it just expires.
- Nobody's watching client domains specifically. Your own infrastructure might be monitored. The fifteen client sites you're also responsible for often aren't — they're "someone else's problem" until the cert lapses and it becomes very much your problem.
What actual coverage looks like
Real SSL monitoring isn't a one-time check - it's three separate things:
- Expiration tracking with real lead time. Not a check the day it expires — an alert 30 days out, 14 days out, and 3 days out, so there's room to actually fix it instead of scrambling.
- Chain and validity, not just expiration. A cert can be unexpired and still broken — wrong domain, incomplete chain, self-signed where it shouldn't be. Checking "is there a cert" isn't the same as checking "is this cert valid for this site."
- Coverage across every domain, not just the ones you remember. The point of monitoring is catching the domain you forgot about, not re-confirming the ones already top of mind.
Where this fits with everything else
SSL expiration is one piece of the same problem as domain expiration and DNS — all three are silent, calendar-driven failures that don't throw an error until it's too late, and all three are the kind of thing that's invisible until a client notices for you. If you're already watching uptime for client sites, SSL, domain, and DNS expiration are the natural next layer — the failures that happen even when the site never technically goes "down."
DownCTL's SSL certificate monitoring checks expiration and validity across every site you manage, with alerts early enough to actually act on, alongside uptime, domain, DNS, and the rest of the operations stack.