SSL certificate expiry notifications
An SSL certificate expiry notification needs to reach the right person, at the right time, through the right channel — before the cert lapses and production goes down.
Most teams discover a certificate has expired from a user complaint, not from their own monitoring. By the time a browser warning appears in production, the window to prevent the outage has already closed. The goal of SSL certificate expiry notifications is to create lead time: enough advance warning that the renewal can be coordinated through normal change management rather than an emergency all-hands.
Staged thresholds are the standard approach. Notify at 30 days for low-urgency awareness, at 14 days to trigger scheduling, at 7 days to escalate if the renewal hasn't happened, and at 1 day as a final emergency alert. Each threshold should fire exactly once — idempotent alerting avoids alert fatigue that causes on-call engineers to start ignoring notifications from the monitoring system entirely.
The notification channel matters as much as the timing. Email is universal but easy to miss in a busy inbox. A dedicated Slack channel — for example, #cert-alerts — ensures the infrastructure team sees the notification without it getting buried. Webhooks integrate directly with PagerDuty, Opsgenie, or any custom handler: a webhook payload can create an incident ticket, page on-call, and link to the runbook, all from a single alert. For the highest-urgency threshold (1 day before expiry), SMS ensures someone is paged even if they are not actively watching Slack.
Expiry notification alone is not enough. You also need to know whether the certificate that will expire is actually the one being served. If auto-renewal already ran and deployed a new certificate, the expiry notification is a false alarm. If the renewal ran but was never deployed — the most common failure pattern — the notification is real and urgent. A monitoring system that probes the live TLS handshake can include the currently-served certificate's expiry date in the notification body, making it immediately clear whether action is needed.
Certificate Transparency log monitoring adds a complementary notification type: new certificate issuance. When a new cert is issued for your domain — whether by your own automation or by an unauthorised third party — you get an immediate alert. This closes the gap between 'a renewal is planned' and 'the renewal actually happened', and also surfaces mis-issuance within minutes of it occurring in the CT log.
Multi-domain notification management is where homegrown solutions break down. A cron script sending one email per expiring cert works for five domains. At fifty domains, the signal-to-noise ratio degrades rapidly. A proper notification system maintains per-domain state, knows which thresholds have already fired for each certificate, and suppresses re-notification when the certificate has been renewed. It also handles the case where a domain temporarily becomes unreachable and should not fire 'expired' alerts while the probe cannot connect.
CertFleet delivers staged, idempotent SSL certificate expiry notifications via email, Slack, signed webhook and SMS. Configure alert channels per domain — each domain can have different channels, thresholds, and recipients. Free for 10 domains with email and Slack. Webhooks and SMS are available from $15/mo. Try the free checker to see a full certificate report for any domain instantly.
CertFleet probes the live certificate, watches Certificate Transparency, and alerts you 30/14/7/1 days before expiry. Free for 10 certificates, no card.