Updated 25 October 2026 · By the Upcertain team
Set it up
- Choose New monitor, then SSL certificate monitoring.
- Enter the hostname whose certificate to check, such as
api.example.com, and the port if it is not 443. - Choose the warning days: up to five, from 1 to 90 days before expiry. The default is 30, 14 and 7.
- Pick the alert channels. A channel receives warnings only if it has the SSL certificate expiry event ticked.
What fails the check
- The certificate has expired.
- It does not cover the hostname.
- The chain does not lead to a trusted root, often a missing intermediate certificate.
What a warning says
"SSL certificate expires in 14 days" with the host, the exact expiry time in your account's time zone, and the issuer. Each chosen day sends one warning per certificate. Webhooks receive the event ssl.expiring with days_left, threshold_days and expires_at.
HTTP monitors already do this
Every HTTPS HTTP monitor checks its certificate and sends the same warnings. Add a separate SSL monitor when the host is not otherwise monitored, or when certificates are someone else's job and their warnings should go to that person's channel.
Questions
Does an SSL monitor check the page's status code?
No. It only checks the certificate. Use an HTTP monitor to check that the page works as well.
Can I monitor a certificate that is not on port 443?
Yes. Enter the hostname and put the port in the Port field, which defaults to 443.