SSL Certificate Monitor
Certificate renewal is normally automated, which is exactly why a quiet failure is dangerous — nobody notices until the expired cert breaks production. This check looks at certificates we've already discovered for the zone and asks a simple question: did a replacement actually get issued?
What we check
We pull the zone's certificates from our database (sourced from Certificate Transparency logs) and select the ones whose expiration falls inside a window from 60 days in the past to 30 days in the future. Each one is matched against the zone's currently-active certificates to see if a replacement exists with all of these properties:
- A different cert (different serial number).
- An expiration date later than the original's.
- The same issuer — matched on the issuer's organization name, so different intermediates of the same CA (for example Let's Encrypt R3 and R10) count as one.
- A subject alt name set that covers every name on the original.
Cloudflare's universal SSL certificates (those carrying a sni.cloudflaressl.com SAN) are skipped — they show up in CT logs but aren't directly user-managed.
Certificates that expired more than 60 days ago are treated as retired services and ignored.
Why it matters
An expired certificate breaks every TLS handshake. If the renewal pipeline silently failed two weeks ago, you have two weeks to find out — but only if something is watching. This check fills that gap by looking at what was actually issued (per CT logs) rather than trusting that the renewal cron ran successfully.
Status outcomes
No certificates fall inside the review window, or every certificate that does has a same-issuer replacement covering the same names.
A certificate is set to expire within the next 30 days and no replacement has been issued yet.
A certificate has already expired (within the past 60 days) and no replacement covering the same domains was issued by the same CA.
How to fix
Issue a replacement certificate from the same CA that covers every name on the original. If the original was retired intentionally, disable the monitor for that zone — once the cert ages past the 60-day cutoff it will stop being checked.
If renewal is automated (ACME, cert-manager, an in-house pipeline), the failure is upstream. Common causes: an HTTP-01 challenge that can't be served, a DNS-01 challenge with a stale credential, or a renewal cron that hasn't run in months.