An expired SSL certificate is one of the few outages that's entirely predictable and still catches almost everyone off guard. You knew the exact date it would expire the day it was issued — and yet it's still one of the most common causes of a site going from "working fine" to "browser security warning" overnight.
Why this keeps happening even with auto-renewal
Most hosts and services auto-renew certificates now, which has made this problem rarer but not gone. Auto-renewal fails silently when a DNS record changes, a domain validation email bounces, or a renewal job on the server quietly stops running after a migration. Nobody checks that a renewal succeeded — they just assume it did, right up until a customer sees "Your connection is not private" and closes the tab.
Why this outage is worse than most
A regular downtime incident looks like a broken page — annoying, but visitors understand sites go down sometimes. An expired certificate looks like a security threat. Browsers show a full-page warning designed to scare people away, and most visitors take that warning seriously and leave immediately rather than clicking through. It also tends to last longer than a typical outage, because certificate issues are often discovered days later, not minutes later, precisely because nothing "breaks" in a way that trips up normal monitoring.
A server going down gets noticed in minutes. A certificate expiring gets noticed in days.
What effective certificate monitoring actually checks
- Days remaining until expiration — not just whether it's currently valid, so you get warned with enough lead time to act.
- The certificate actually presented by the server — not just the DNS record, since a misconfigured server can present the wrong cert entirely.
- Every subdomain independently — a wildcard cert covers everything, but a per-subdomain cert on an API or checkout subdomain can expire on its own schedule.
Building this into your existing monitoring routine
The simplest fix is to stop treating certificate expiration as a separate problem from uptime monitoring — an HTTPS check that alerts on certificate errors catches both a server going down and a certificate quietly expiring, in the same monitor. PingKeeper checks your site over HTTPS on the same schedule as any other monitor, so a cert issue triggers the same Telegram alert as a server outage would. Free covers 3 monitors to start; details on the pricing page.
Stop finding out about outages from customers.
Free forever for up to 3 monitors — set one up in under a minute.
Start monitoring free