SSL certificate expiry is one of the most embarrassing — and entirely preventable — causes of major outages. Every few months another high-profile company makes headlines because a certificate expired, taking down their API, their website, or a payment gateway. The fix is always the same: renew the certificate. The cost before the fix: hours or days of downtime, customer complaints, and engineering time spent on an emergency that should have been routine maintenance.
This guide explains why SSL expiry keeps causing outages despite being completely predictable, how to monitor certificates proactively, and how to configure expiry alerts in Vigilmon to catch problems weeks before they become incidents.
Why SSL Certificate Expiry Keeps Causing Outages
If certificate expiry is predictable — every certificate has an explicit expiry date — why does it keep catching teams off guard?
Certificate inventories sprawl. A mature company might have hundreds of certificates: production API endpoints, internal services, staging environments, subdomains, partner integrations, CDN edge certificates, and client certificates. No single person has a complete list. The one that expires at 2 AM on a Saturday is the one no one thought to include in the renewal spreadsheet.
Renewal processes fail silently. Many teams use Let's Encrypt with automated renewal via Certbot or ACME clients. These work reliably — until they don't. A change in DNS configuration, a lapsed IAM permission, a server migration that left Certbot running in the wrong directory — the automated renewal fails, no one notices, and 90 days later the certificate expires. The automation isn't monitored.
Internal services get forgotten. Monitoring and renewal workflows typically focus on public-facing endpoints. Internal services — admin dashboards, internal APIs, monitoring infrastructure, build systems — often run with longer-lived certificates that nobody watches.
Acquired and inherited infrastructure. Acquisitions bring certificate inventories nobody has full context on. Infrastructure inherited from previous engineering teams often includes certificates that aren't in any current renewal workflow.
The 90-day Let's Encrypt cycle is unforgiving. Free certificates from Let's Encrypt expire every 90 days, which puts automated renewal under significant time pressure. A two-week gap in automation monitoring can mean missing a renewal window.
What Happens When an SSL Certificate Expires
The immediate effect of an expired certificate depends on who is connecting and how:
Browsers show security warnings. Chrome, Firefox, and Safari all display an interstitial warning page for expired certificates. Users who don't understand TLS (most of them) will leave. Users who do understand it will be concerned regardless. No one converts on a security warning page.
API clients fail with errors. Most HTTP clients — curl, requests, axios, fetch — will reject connections to servers with expired certificates and throw a TLS error. This breaks integrations, mobile apps, webhooks, and any system-to-system communication that doesn't explicitly disable certificate validation.
Internal tools stop working. Engineers who rely on internal dashboards, CI/CD systems, or internal APIs hit certificate errors and have to find workarounds. Productivity stops.
Partner and payment integrations fail. Payment gateways, webhook receivers, and third-party integrations often have stricter certificate validation than browsers. An expired certificate can break payment processing entirely.
The recovery path — renewing and deploying the certificate — is usually fast if you have the access and know-how. But the time to realize what happened, locate the certificate, renew it, and deploy it is often measured in hours, not minutes.
Certificate Monitoring: What to Watch
Effective SSL certificate monitoring involves more than checking whether a certificate has expired. By the time it's expired, you've already had an incident. The goal is to catch problems early enough to act.
Expiry countdown
Monitor days until expiry for every certificate in your inventory. Alert thresholds:
- 30 days remaining: Informational alert — renewal is due, add it to the next sprint
- 14 days remaining: Escalated alert — renewal is overdue, assign to an owner today
- 7 days remaining: Urgent alert — drop everything, renew immediately
- 3 days remaining: Critical alert — page someone
If you're using 90-day Let's Encrypt certificates, 30 days isn't much buffer. Consider starting the escalation at 45 days for short-lived certificates.
Certificate chain validity
An expired certificate isn't the only way TLS fails. A misconfigured certificate chain — where the intermediate certificate isn't served correctly — causes TLS errors in strict clients even when the leaf certificate is valid and current. Monitor that the full chain is being served correctly.
Domain name mismatch
A certificate renewed for api.example.com that gets deployed to www.example.com will cause TLS errors because the domain name doesn't match the certificate's Subject Alternative Names (SANs). Monitor for domain name mismatches, especially after certificate renewals.
Algorithm and key strength
SHA-1 certificates have been deprecated for years, but they still turn up in old infrastructure. Monitor for certificates using deprecated algorithms or key strengths below 2048-bit RSA or equivalent.
Wildcard vs. specific certificates
Wildcard certificates (*.example.com) cover all first-level subdomains but not second-level ones — api.v2.example.com wouldn't be covered. Know which of your certificates are wildcards and which subdomains they cover.
Setting Up SSL Certificate Monitoring in Vigilmon
Vigilmon monitors SSL certificates as part of its HTTP monitoring — every HTTP monitor automatically checks certificate validity and reports days until expiry.
Step 1: Add monitors for all public-facing HTTPS endpoints
Add an HTTP monitor for each production endpoint:
- Go to your Vigilmon dashboard and click Add Monitor
- Choose HTTP / HTTPS
- Enter the URL of the endpoint (e.g.,
https://api.yourapp.com/health) - Set check interval to 1 minute
- Vigilmon automatically checks the SSL certificate on every HTTP request
Step 2: Configure SSL expiry alerts
For each monitor, configure SSL expiry notification thresholds:
- In the monitor settings, find SSL certificate alerts
- Set an alert for 30 days before expiry routed to email or Slack
- Set an alert for 7 days before expiry routed to PagerDuty or SMS
- Enable alert on certificate error — this fires immediately if Vigilmon encounters a certificate validation error, which means an already-expired or misconfigured certificate
Step 3: Add monitors for internal services
Don't skip internal services. Add HTTP monitors for:
- Internal admin dashboards
- Internal APIs used by other services
- Staging and preview environments (these expire too)
- Build and CI/CD systems with HTTPS endpoints
- Monitoring infrastructure itself (a monitoring tool with an expired certificate is ironic but not rare)
For internal services that aren't publicly accessible, use Vigilmon's TCP monitoring from within your network perimeter, or set up an internal health check endpoint that Vigilmon can reach through a firewall allowlist.
Step 4: Monitor the renewal automation
If you're using automated certificate renewal (Let's Encrypt / ACME), monitor the renewal job itself with a heartbeat monitor. A heartbeat monitor in Vigilmon fires if your job doesn't ping within the expected interval — catching silent automation failures before they become expiry incidents.
Add a heartbeat ping to your Certbot or ACME client renewal cron job:
# In crontab: run renewal check daily at 3 AM
0 3 * * * certbot renew --quiet && curl -s -X POST https://vigilmon.online/api/heartbeat/YOUR_HEARTBEAT_ID
If the renewal fails, Certbot returns a non-zero exit code and the curl command doesn't run — Vigilmon alerts that the heartbeat was missed. If the entire cron job stops running, the heartbeat also goes silent.
Certificate Renewal Workflow Best Practices
Monitoring catches the problem; a good renewal workflow fixes it quickly.
Use automated renewal where possible
Let's Encrypt with Certbot (or a modern ACME client like acme.sh or cert-manager for Kubernetes) handles the renewal lifecycle automatically. This is almost always better than manual renewal for short-lived certificates, but it requires monitoring the automation.
For certificates issued by a CA that doesn't support ACME (extended validation certificates, private CA-issued certificates, wildcard certificates from some providers), build a calendar reminder workflow and monitor the certificate separately.
Maintain a certificate inventory
Keep a list of every certificate your organization owns:
| Domain | CA | Expiry Date | Auto-renewal | Owner | Vigilmon Monitor | |--------|----|-------------|--------------|-------|-----------------| | api.example.com | Let's Encrypt | 2026-09-12 | Yes (Certbot) | Platform team | Yes | | admin.example.com | DigiCert | 2026-12-01 | No | Security team | Yes |
This doesn't need to be sophisticated — a shared spreadsheet is fine. The goal is ensuring every certificate has a known owner and is covered by a Vigilmon monitor.
Practice certificate rotation
Rotating a certificate in production should be routine, not stressful. Practice it before you need to do it under pressure. Know the deployment path for each certificate type in your infrastructure.
Set renewal reminders earlier than you think you need
Most engineers set renewal reminders based on how fast they think they can renew a certificate. Set them based on how long it could plausibly take if everything goes wrong: the CA has a multi-day verification backlog, the deployment pipeline is broken, the person with production access is on vacation. 30 days is the minimum; 60 days is better for certificates that require manual renewal.
Responding to a Certificate Alert
When Vigilmon fires a certificate expiry alert, the response depends on the time remaining.
30+ days remaining: Schedule the renewal in your issue tracker. Assign an owner. No urgency, but don't defer it indefinitely.
14 days remaining: Treat as a medium-priority incident. Verify that automated renewal is configured and working. If manual renewal is required, begin the process now.
7 days remaining: This is an active incident. Escalate to the service owner. Block on completing the renewal. Check whether the automated renewal is broken and fix the automation as well as the immediate issue.
Expired or certificate error: This is a production incident. Follow your standard incident response process. Communicate via status page. Renew and deploy the certificate as fast as possible — don't spend time diagnosing root cause until service is restored.
Vigilmon's SSL Monitoring in Practice
Vigilmon checks the SSL certificate on every HTTP request it sends, from multiple geographic probe nodes. This means you get:
- Continuous validity checking — not a once-daily cert scan, but every-minute validation
- Multi-region confirmation — if a certificate is expired, all probe nodes will see it, not just one
- Expiry countdown in the dashboard — you can see at a glance which certificates are approaching expiry
- Integrated alerting — certificate alerts go through the same notification pipeline as uptime alerts, so you can route them to PagerDuty, Slack, email, or webhooks
The response time history chart also shows whether certificate errors are affecting response time — a misconfigured certificate chain often causes significantly slower TLS handshakes even before it causes hard failures.
Getting Started
Setting up SSL certificate monitoring in Vigilmon takes less time than writing a calendar reminder. Add your five most critical HTTPS endpoints as HTTP monitors, configure expiry alert thresholds, and add a heartbeat monitor for your certificate renewal automation.
Try Vigilmon free at vigilmon.online — 5 monitors included on the free tier, no credit card required. SSL certificate monitoring is included on all plans.
Summary
SSL certificate expiry is the most preventable category of production outage. Every certificate has an explicit expiry date — the problem is that no one is watching. Vigilmon monitors every HTTPS endpoint for certificate validity on every request, alerts you weeks before expiry, and catches misconfigured certificate chains before they cause TLS errors. Add heartbeat monitoring for your renewal automation and you've closed the most common failure mode: automated renewal that breaks silently. Set it up once, and certificate expiry incidents become a solved problem.