Continuous SSL/TLS certificate monitoring

A cron job that runs once a month to check certificate expiry dates is not continuous monitoring — it is a snapshot with a 30-day blind spot between checks. Renewals can fail silently within that window. An auto-renewal can run but deploy the wrong certificate. A certificate can be replaced by one with a shorter validity period by an operations mistake. A staging environment can be left running with a cert that expires mid-sprint. Continuous monitoring runs on a fixed schedule — every few hours for free accounts, more frequently on paid plans — and reacts to what it finds after every sweep.

Each monitoring sweep performs a genuine TLS handshake on port 443 and reads the full X.509 certificate your server presents. The result is compared against the fingerprint stored from the previous probe. If the fingerprint is the same, the check passes and the expiry countdown updates. If the fingerprint differs, the change is logged and an alert fires. This means every certificate replacement — whether a planned renewal, an emergency reissue, or an unexpected substitution — appears in the monitoring history and triggers a notification.

Change detection signals go beyond expiry date. A new issuer on an unchanged domain means someone switched CAs — intentional or not. A shortened validity window (e.g., moving from a 1-year cert to a 90-day cert) changes the renewal cadence for that domain. An unexpected Subject Alternative Name appearing or disappearing in the cert could indicate a misconfigured renewal or a spoofing attempt. A new certificate appearing in Certificate Transparency logs before it reaches port 443 is an early signal that a renewal is in progress — or that an unauthorized cert has been issued for your domain.

The history view stores every probe result with a timestamp: the certificate fingerprint, issuer, expiry date, TLS version, and any change events. This data is the foundation for post-mortems ("when exactly did the old cert get replaced?"), for compliance audits ("show me every cert change on this domain over the last 90 days"), and for correlating certificate events with deployment timelines or incident reports. Each domain's full history is accessible from the dashboard and via the REST API.

CertFleet runs on Cloudflare Workers with an external TLS probe — there is no agent to install on your servers, no sidecar to deploy, no infrastructure to maintain. The probe originates from a distributed network of nodes so that a single origin IP being blocked does not create a false negative. The monitoring infrastructure itself has no single point of failure; Workers run globally and the probe schedule is resilient to individual node failures.

Continuous SSL monitoring pairs naturally with DNS monitoring and uptime monitoring. A DNS change can redirect a domain to a different server serving a different certificate — the SSL monitor will detect the fingerprint change. An expired certificate causes an uptime monitor to fire 'down' with a TLS error — but the SSL monitor will have been alerting for 30 days before that point. Running all three types gives you pre-failure warnings, real-time state change detection, and availability confirmation in a single dashboard.