A certificate expiry alert warns you in advance that a TLS/SSL certificate will soon stop being valid. It is triggered by comparing the certificate's notAfter date with the current date and a threshold you choose, for example 30, 14 and 7 days.
Why it matters
When a certificate expires, browsers show a full-page warning and API clients refuse to connect, which for most visitors looks like an outage. Even with automated renewal, things fail: a DNS change breaks validation, a cron job stops, or a new server never got the renewal client. Multi-stage alerts give you time to fix the cause calmly. Shorter certificate lifetimes make automation and checking more important, not less.
Example
A manual check that can be scripted:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -enddate
notAfter=Jan 14 09:00:00 2027 GMTAlert at 30 days to investigate, 14 days to escalate, and 3 days as urgent. Check every hostname and every endpoint, including mail servers and API domains.
Common mistakes
- Monitoring only the main site and missing subdomains, load balancers or mail ports.
- Checking the certificate on a CDN edge while the origin certificate quietly expires.
- Sending alerts to a former employee's mailbox.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.