On-demand SSL renewal watchlist
Check several hosts in one run, sort certificates by days remaining, choose a renewal review threshold, save a watchlist in this browser and copy a renewal report before an expired certificate interrupts visitors, APIs or admin access.
This is an on-demand monitor, not a background alert service. The saved list stays in this browser so you can rerun the check quickly.
Why an SSL expiry monitor belongs in the admin routine
SSL expiry failures are simple and brutal. Visitors see browser warnings, API clients refuse connections, embedded services fail and support tickets arrive before the root cause feels dramatic. The certificate may have renewed correctly last month and still fail this month because a DNS challenge broke, a CDN hostname changed, a staging host became public or the account that owned renewal is no longer watched.
A watchlist turns that risk into a small routine. Instead of checking one domain when someone remembers, you can keep public hostnames together, run a batch check, sort by remaining time and see which certificate needs attention first. This matters for main sites, www hostnames, dashboards, APIs, payment or login domains, client microsites and any tool subdomain that users rely on.
What this on-demand monitor checks
- The certificate currently served for each hostname on port 443.
- Validity dates and days remaining.
- Issuer and subject common-name clues where they are returned.
- Whether the checked hostname appears covered by SAN or subject matching in the parsed certificate summary.
- The review date implied by your chosen threshold.
- Connection or certificate failures that need immediate investigation.
How to choose a renewal threshold
Fourteen days is a tight warning window. Thirty days is a sensible minimum for many small websites. Sixty days is calmer when DNS validation, CDN edges or several stakeholders are involved. Ninety days is useful when your team wants renewal work visible before a certificate enters its last operational cycle. The right threshold is not about panic; it is about leaving enough time to fix the challenge path and retest public hostnames.
A practical renewal workflow
- Keep the watchlist focused on hostnames that real users or integrations open.
- Run it before migrations, DNS changes, CDN changes and release windows.
- Review the soonest certificate first, then failures, then hostname mismatches.
- Confirm auto-renew, DNS challenge ownership and manual fallback before the last week.
- After renewal, rerun the exact public hostname and inspect headers or redirects if HTTPS behavior changed.
Monitoring is more than one date
Expiry is the urgent signal, but the surrounding process matters. A certificate with plenty of time left can still be wrong for a new hostname. A successful renewal can land on origin while the CDN still serves another certificate. A wildcard can cover one class of subdomains while a deeper name remains outside it. Keep the checker and the watchlist together: use the monitor for renewal triage, then open the certificate checker when one host needs a closer read.
Common questions
Will this send me an email when SSL expires?
No. This page runs a live watchlist check when you ask for it and can save the host list in the current browser. A true alerting service needs scheduled checks and notification delivery.
Should I monitor the apex and www names separately?
Yes when both names are public. They may terminate at different edges or redirects, and a problem on the less-used hostname still hurts visitors who reach it.
What should I do when a host fails the SSL check?
Check DNS, port 443 reachability, CDN or proxy configuration and the certificate automation path. If the host should not be public anymore, remove it from the watchlist and close the exposure deliberately.
How early should I renew an SSL certificate?
Renew at least two to four weeks before expiry. An expired certificate makes browsers block the site with a full-page warning, so leave margin for any deployment issues.
Why did my certificate expire if I use Let’s Encrypt auto-renewal?
Auto-renewal silently fails when the renewal cron stops, the validation path breaks, or the web server is not reloaded. Monitor expiry independently so a failed renewal does not surprise you.
Can I monitor several domains at once?
Yes, list each host and the tool reports the days remaining for every certificate so you can spot the one about to lapse.
