SSL certificate expiry monitoring

The problem

Certificates expire on a fixed date, and automatic renewal fails more often than you would think: a changed DNS record, a firewall rule, a server that was moved. Nobody notices until the date has passed.

Certificates outside the main website are easy to forget: a mail server, a VPN portal, an API on another port.

Why it matters

An expired certificate puts a full-page warning in front of every visitor, and APIs and apps simply refuse to connect. It looks like an outage, and it is one.

Certificate lifetimes are getting shorter, which means more renewals and more chances for one to fail.

How to check it manually

Read the expiry date with openssl:

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null |
  openssl x509 -noout -enddate

Or click the padlock in your browser and open the certificate details. Then put a reminder in your calendar, for every certificate.

How DoubleCheck checks it

DoubleCheck opens a TLS connection to your host and port, just like a browser, and reads the certificate the server actually presents. That is the one that counts, not the one in your certificate store.

It checks the date and also whether the certificate is trusted and matches the host name, so a wrong or self-signed certificate is caught as well.

Measures

A TLS connection to your server (port 443 unless you set another), reading the expiry date of the certificate the server presents.

Runs

Every minute by default. You set the interval per check.

Status

• OK when the certificate is valid for 30 days or more.
• Warning when it expires within 30 days.
• Error when the certificate has expired, is not trusted, does not match the host name, or the server cannot be reached.