How to monitor SSL certificate expiry

Auto-renewal fixed most expiries and created a new failure mode: nobody looks any more, so when renewal breaks, nobody knows until browsers show the warning.

Check manually

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

Common reasons renewal fails

• DNS challenge stops working after a DNS provider change
• HTTP challenge blocked by a new redirect or firewall rule
• Rate limits after too many attempts
• The renewal cron job itself stopped running

Automate the reminder

A monitor that reads the certificate on every check and alerts at 30, 7 and 1 day is the safety net. Use the free SSL checker to see your current expiry date.