Shrinking SSL lifetimes and the potential fallout have been a hot topic on this blog lately, and we’re not putting it to rest quite yet. After all, it’s an important topic for SSL owners, especially those with multiple sites and servers. Preparation is key if you want to ensure your certificates renew on time every time, keeping everything live.
Integral to that is SSL management and the importance of continually monitoring your SSL inventory, but what about the tools that help you do it? There are an array of free and paid tools out there, and some are more heavy-duty than others. How do you know what’s best for your situation?
Keep on reading to find out.
What SSL monitoring needs to check
Monitoring doesn’t only mean expiration date, though that is an essential element. There are a range of other factors that can impact whether or not your SSL works properly, such as:
Missing/broken intermediate certificate
An intermediate certificate is the bridge between your SSL and the Certificate Authority (CA’s) trusted root certificate. It creates a secure chain of verification, and it proves your SSL is authentic to browsers or any client connecting to your server. It lives alongside your primary SSL on the server, and if it’s for some reason missing, your site may be flagged as insecure.
Hostname mismatch
Sometimes an SSL might be valid, but the hostname doesn’t match the site where it’s installed. This is common after site migrations or multi-domain certificate changes.
Renewal success or failure
Even when things are automated, sometimes renewal requests can fail due to various factors, such as an incomplete validation step or a script error. Certificate monitoring ensures such SSLs aren’t forgotten.
If the right certificate is live
Sometimes certificates can slip through the installation cracks after a renewal, with the old SSL left on a server, CDN, or load balancer rather than the replacement. A monitoring tool will check via TLS handshake whether or not the SSL has been updated.
Certificate transparency
A monitoring tool will keep track of certificate transparency logs, which spot certificates issued for your domain that you didn’t request, whether due to a CA mistake or someone fraudulently obtaining an SSL in your name.
How automated monitoring works
Automation monitoring tools cover a lot of ground that would be difficult to do manually. Here’s a quick look at how:
- Scheduled checks against the website itself – The tool will periodically connect to the site and check the installed certificate using the TLS handshake, the same security check a browser does when it loads your site.
- Sends tiered expiration alerts – The tool will send the relevant team standard tiered pattern alerts (30/14/7/1 days before). This pattern helps teams renew and replace an SSL in good time.
- Get alerts where you need them – Whether it’s by email, Slack, or escalation tools, you can set it up so the tool alerts someone who can act when needed.
- Regular scheduled checks – These tools generally perform checks daily. More frequently would be a waste of resources, while less may pick up changes too late.
Free tools for SSL monitoring
For low-budget teams, there are several free options available, ranging from automated monitoring platforms to tools for performing manual certificate checks.
- Uptime Kuma – A free, open-source, self-hosted monitoring platform that can monitor HTTPS services and provide certificate expiry notifications. It’s a useful option for individuals and teams that want automated SSL alerts without paying for a commercial monitoring service, although you’ll need to host and maintain Uptime Kuma yourself.
- Better Stack – A general uptime monitoring platform that includes SSL monitoring in its free tier. Can monitor up to 10 sites.
- crt.sh – A lookup tool rather than an alert tool. Checks certificates issued for a domain so you can spot things like unexpected or unauthorized issuance.
- SSL Labs (Qualys) – An in-depth SSL inspection tool that grades TLS configuration, from chain validity to vulnerabilities. It isn’t a continuous monitoring service, so checks need to be initiated manually.
- OpenSSL CLI (openssl s_client) – If you’re technically proficient, you can inspect a live certificate and check details such as its validity dates directly from the command line. It can also be incorporated into scripts for automated checks.
Paid monitoring and lifecycle management tools
More continuous monitoring tools become available if you’re able to pay. They can be split into three different types.
- CA-specific monitoring tools such as DigiCert Trust Lifecycle Manager and Sectigo Certificate Manager
- General SSL certificate lifecycle management (CLM) platforms not tied to any specific CA, such as Keyfactor and CyberArk Certificate Manager
- General infrastructure monitoring that includes SSL monitoring, such as Datadog
How to choose the right approach
The kind of tool you use for monitoring is highly dependent on your situation, from the number of certificates you have to your budget and whether or not you have a dedicated security team. The table below should simplify making the right choice.
| If you have… | Choose this |
| A handful of public-facing site SSLs | Free tools |
| A wide variety of SSLs across public sites and internal tools from one CA | A CA-specific CLM platform that automatically finds every certificate across your systems |
| Multiple certificates from multiple CAs | A general CLM platform that monitors all SSLs, regardless of the issuing CA |
| No dedicated person to maintain automation → Hosted monitoring service with built-in SSL alerts | Free tools |
| A dedicated security team | A general or CA-specific CLM platform, depending on your situation |
| A general monitoring platform like Datadog | Add-on SSL checks |
| Compliance/audit requirements (PCI-DSS, SOC 2, ISO 27001) | A general CLM platform built for reporting and audit trails |
Best practices for certificate monitoring
Assigning ownership and multiple alert channels
Alert emails have a high chance of getting lost, especially when there isn’t someone specific in charge of renewing specific certificates. Combining email reminders with alerts from your team’s communications app and an escalation tool will ensure whoever’s in charge will be alerted on time.
Monitor renewals
Confirm the renewal process was carried out successfully. Sometimes it might seem like a renewal succeeded, but the live certificates are incorrect, especially when there are multiple certificates to replace.
Review monitoring reports on a schedule
The key to catching anything wrong is not just relying on alerts. Taking a look at your monitoring dashboard every so often may reveal forgotten certificates and old, missed warnings.
Common mistakes
Monitoring only the public certificates
It’s easy to fall into only keeping track of certificates on your public-facing sites and services, but it’s crucial to monitor APIs, mail servers, and other internal services, too. Otherwise, something might break down the line, and the cause may not be immediately clear.
Not updating monitoring configurations amid infrastructure changes
As domains and servers are updated or swapped out over time, monitoring tools must be updated to reflect that. Otherwise, you run the risk of forgetting certain SSLs entirely.
Quick checklist for ensuring you monitor effectively
- List every SSL you have and its location, from public sites to internal tools
- Confirm each one is being monitored
- Check expiration date, chain validity, and hostname match
- When you renew, check that the installed SSL matches the new one
- Assign an owner to SSL renewals and create multiple alert channels
- Schedule regular reviews for your monitoring dashboard
- Update your monitoring setup every time infrastructure changes
The takeaway
As certificate lifetimes shorten, continuous monitoring is the best way to prevent certificate-related outages on public-facing sites as well as back-end infrastructure. By following the advice in this article and choosing the right tool for your particular needs, you’ll get on top of your SSL monitoring in no time at all.
Frequently asked questions
How often should SSL certificates be checked?
The standard for most monitoring tools is to check certificates daily, which will help you act in good time if an issue is flagged.
Is monitoring worth it for a single small site?
Monitoring is always a good idea, but you can probably rely on a simple, free tool rather than paying for a CLM platform.
Can SSL monitoring catch a failed renewal?
Yes. SSL monitoring tools regularly check live certificates, so you can find out if a renewal failed due to a validation error or something else, as well as renewals that were technically a success but didn’t install properly.
Are free SSL monitoring tools really enough?
It all boils down to your specific needs. If you have one or two websites, free tools that offer expiration tracking, alerts, and TLS handshake checks should be enough. But for those with certificates across a variety of sites and servers, a more powerful paid platform is recommended.
What’s the difference between “monitoring” and “certificate lifecycle management”?
Monitoring is watching the certificates to catch any issues and report them to you. As the name suggests, certificate lifecycle management covers the whole SSL lifecycle: issuance, renewal, installation, and revocation.
Cora is a digital copywriter for SSLs.com. Having eight years of experience in online content creation, she is a versatile writer with an interest in a wide variety of topics, ranging from technology to marketing.