SSL Expiration Check Checklist: Keep Your Certificates Valid

Before You Start: Prerequisites for SSL Expiration Monitoring

Before you automate anything, you need a solid foundation. Honestly, most system administrators skip this step and end up with gaps in their coverage. Don't be that person.

Start by compiling a complete inventory of every domain and subdomain that has an SSL certificate attached. This includes wildcards (*.example.com), multi-domain certificates (SAN certs), and internal services exposed via reverse proxies. Miss one, and you're gambling with an outage.

• Domain and certificate inventory – Create a master list of all hostnames, including test, staging, and production environments. Don't forget legacy systems that might still serve HTTPS. A spreadsheet works, but a dedicated managing SSL certificate expiry platform like crtmgr.com imports this automatically via API or CSV upload.
• Network access verification – Your monitoring server needs to reach each endpoint on port 443 (and 8443 for some internal tools). Firewalls, VPNs, and load balancers can block these checks. Test connectivity with nc -zv example.com 443 before you automate anything. If you can't connect, you can't monitor.
• Monitoring frequency decision – Critical domains (e-commerce, login portals, APIs) should be checked daily. Less critical sites (blogs, documentation) can be checked weekly. Why the difference? An expired e-commerce certificate costs you revenue in minutes. A blog certificate? You've got hours, maybe a day.
• Tool selection – You have options: open-source scripts, monitoring suites, or dedicated services. For automated, multi-domain tracking that doesn't require constant babysitting, crtmgr.com is the most practical choice. It handles the heavy lifting – discovery, expiry tracking, and alerting – across hundreds of domains.

Set Up Automated SSL Expiration Checks

Manual checks are a recipe for disaster. You've got better things to do than SSH into a server and run openssl commands every morning. Automation isn't optional; it's essential.

Use a Centralized Monitoring Platform

Register all your certificates in a dashboard that checks expiry daily and sends alerts when renewal is due. crtmgr.com offers push, email, and webhook notifications, so you never miss a warning. The platform also provides a real-time SSL monitoring view of every certificate's status – valid, expiring soon, or expired.

Why centralized? Because spreadsheets get stale. Because email inboxes overflow. Because when you manage 50+ certificates across multiple teams, you need a single pane of glass. A platform like crtmgr.com also automatically discovers new certificates as you add domains, reducing manual overhead.

Leverage Open-Source Scripts

If you prefer a DIY approach (and have time to maintain it), OpenSSL and bash scripts work fine for small environments. A typical one-liner:

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate

Pipe that through date and diff, run it via cron, and you've got basic SSL expiration check automation. But here's the catch: scripts fail silently. If the server is down during the cron run, you get no alert. If the certificate changes mid-cycle, your script might report the wrong expiry. For production environments, dedicated certificate expiration alert software is far more reliable.

Set a minimum validity threshold – typically 30 days for a warning, 7 days for a critical alert. Anything under 30 days should trigger immediate action. Why? Because renewal isn't instant. Certificate authorities can take hours to validate and issue replacements, especially for EV certificates.

Verify Certificate Chain and Domain Coverage

An expired certificate is obvious. A broken chain? That's insidious. It causes browser warnings that erode user trust without you even knowing. This step is where most SSL certificate health check processes fall short.

• Full certificate chain validation – Your server must serve the intermediate and root certificates alongside your leaf certificate. Missing intermediates cause warnings in browsers, mobile apps, and API clients. Use openssl s_client -showcerts -connect example.com:443 to verify the complete chain. If you see only one certificate returned, something's broken.
• Subject Alternative Name (SAN) coverage – A certificate that doesn't cover all your hostnames is effectively invalid for those domains. Check with openssl x509 -in cert.pem -text -noout | grep -A1 'Subject Alternative Name'. If you've added a new subdomain, make sure it's in the SAN list. Wildcards cover one level only – *.example.com does not cover sub.domain.example.com.
• Load balancer and CDN endpoint testing – Cloudflare, AWS CloudFront, and internal load balancers often serve different certificates than your origin server. Test each endpoint independently. A common failure: you renew the origin certificate but forget to update the CDN's SSL configuration. Real-time SSL monitoring across all endpoints catches this.

Configure Alerts and Escalation Paths

Alerts that nobody sees are worse than no alerts at all. They give you a false sense of security. This is where you build a safety net that actually catches you when you fall.

Set Up Multiple Notification Channels

Email alone isn't enough. What if your email server is down? What if the alert lands in the spam folder? Configure at least two channels. crtmgr.com supports email, Slack, PagerDuty, and webhooks natively. Send critical alerts to all channels simultaneously. For less urgent warnings, email and Slack might suffice.

Think about your team's workflow. If you're on-call, PagerDuty or Opsgenie integration is non-negotiable. If you're a small team, a Slack channel dedicated to SSL alerts works fine. The key is redundancy – if one channel fails, another catches the alert.

Define Escalation Rules

Create a tiered alert system:

• 30 days before expiry – Informational warning. Email to the certificate owner. "Your cert expires in 30 days. Plan renewal."
• 14 days before expiry – Reminder. Email + Slack. "Action required within 7 days."
• 7 days before expiry – Critical. Email, Slack, PagerDuty. "Immediate renewal needed."
• Expired – Emergency. All channels, plus SMS if supported. "Certificate has expired. Take action now."

Assign a backup admin for each domain. If the primary contact doesn't acknowledge the 7-day warning within 24 hours, the backup gets notified. This prevents single points of failure – what if the primary is on vacation? What if they left the company?

Schedule Regular Manual Audits

Automation handles the routine. But automation can't catch everything. You need a human in the loop periodically. This isn't about distrusting your tools; it's about covering edge cases that scripts miss.

Quarterly audits are the sweet spot. Cross-check your monitored list against actual certificates. Use crtmgr.com's discovery scan to find certificates you might have missed. Alternatively, run nmap --script ssl-cert -p 443 example.com to enumerate certificates on a network. Compare the results against your monitoring dashboard. Any gaps? Fill them immediately.

Review renewal processes for certificates that require manual intervention. EV certificates often need human validation. Legacy systems (old IIS servers, embedded devices) might not support automated renewal. Document these exceptions and ensure they're on someone's calendar.

Finally, update your monitoring configuration whenever you add or decommission a domain. This sounds obvious, but I've seen teams add a new subdomain, deploy a certificate, and forget to add it to the monitoring tool. Three months later, it expires silently. A quarterly audit catches this.

"An SSL expiration check is only as good as the process behind it. Automate the routine, audit the exceptions, and never trust a single alert channel."

This checklist isn't exhaustive, but it covers the essentials. Start with the inventory, automate the checks, verify the chain, configure redundant alerts, and audit quarterly. Do that, and you'll never wake up to an expired certificate again.

For teams managing more than 10 certificates, a dedicated platform like crtmgr.com turns this checklist into a set-it-and-forget-it workflow. It handles the SSL expiration check, sends email notifications for SSL expiry, and provides real-time SSL monitoring across all your domains. Less firefighting, more sleeping at night.