SSL / TLS Monitoring

Certificate expiration is one of the most preventable causes of website outages — yet it happens constantly, to organizations of every size. The reason is simple: certificate management is easy to forget. An annual renewal reminder arrives, gets buried in an inbox, or is assigned to someone who has since left the organization. Ninety days later, the certificate expires at 3 AM, and every visitor to your site sees a browser security warning before your team knows anything is wrong.

Modern certificates issued by Let's Encrypt and other automated CAs have reduced some of this risk, but automation introduces its own failure modes. An ACME renewal script that silently fails, a DNS challenge that stops resolving correctly, or a server that stops accepting renewed certificates — all result in the same outcome: an expired certificate causing a live outage.

SSL monitoring provides a continuous safety net. Rather than relying on a single renewal reminder, it checks your certificates regularly, surfaces problems well in advance, and validates the full chain — not just the expiry date. When auto-renewal breaks, monitoring catches it before visitors do.

The business cost compounds quickly. An outage during a sales promotion or product launch costs revenue directly, while the browser security warning itself damages trust with every visitor who sees it — long after the certificate is renewed. If the affected service is covered by a customer SLA, an avoidable certificate lapse can trigger service credits or contract penalties that a five-minute renewal would have prevented entirely.

NetTests connects to your HTTPS endpoints over TLS and performs a comprehensive inspection on every scheduled check. This includes validating the certificate chain from your end-entity certificate up through any intermediate CAs to a trusted root, confirming the certificate has not been revoked via OCSP, measuring the days remaining until expiration, and verifying that the hostname matches the certificate's Subject Alternative Names.

The check also evaluates the TLS configuration itself: which protocol versions are offered (TLS 1.2, TLS 1.3), which cipher suites are supported, and whether known-weak configurations are present. A certificate that is technically valid but uses deprecated ciphers represents a security risk that certificate expiry monitoring alone would not catch.

Alerts are dispatched on a configurable schedule — for example, 30 days before expiry, then again at 14 days, 7 days, and 1 day. You choose the thresholds. If a certificate changes unexpectedly — different issuer, different SANs — NetTests flags the change on the next check, giving you early warning of a potential misconfiguration or certificate substitution.

Alerts reach your team through email, Slack, Microsoft Teams, or SMS — pick one channel or several, per monitor. The dashboard lists every certificate you track sorted by days remaining, so the most urgent renewal always sits at the top. Click into any certificate to see its full chain, cipher suite, and OCSP status alongside a history of every previous check — useful when comparing today's configuration against what was deployed before a renewal.