An expired certificate is the most embarrassing outage there is. Nothing is actually broken – the server is up, the database is fine – and yet every visitor sees a full-page red warning that your site "is not secure". Conversion drops to zero until someone notices.
"But we use Let's Encrypt, it renews itself"
Until it does not. The renewal cron job silently stops after a server migration. A firewall rule blocks the validation request. The DNS record for a subdomain changes and the wildcard stops validating. The certificate on the load balancer is not the one on the origin. Every team that has run websites for a few years has a story. Automation reduces the risk; it does not remove the need to watch.
Watch the certificate itself, not the renewal job
The only reliable signal is the one your visitors see: connect to the site over TLS and read the certificate that comes back. That catches every failure mode at once – wrong certificate deployed, chain incomplete, renewal never happened – regardless of which tool was supposed to renew it.
Warn early, alert on expiry
Ravnsight's certificate monitor records issuer, validity, days left and the chain on every check. Inside your warning window (14 days by default, adjustable per monitor) you get a warning once a day – not an incident, because nothing is down yet. An expired or invalid certificate is an outage and goes through normal confirmation and alerting.
Check it yourself in ten seconds
To see exactly what the server hands out – not what you think it hands out – ask it from the command line:
openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -dates -issuerLook at three things: notAfter is far enough ahead, the issuer is the one you expect, and (run the first half on its own) the server sends the full chain, not just its own certificate. A missing intermediate certificate often works in your browser and fails on older phones and in API clients – which is exactly why it slips through manual checks.
Every hostname has its own certificate
www, shop, the API subdomain and the mail server can each carry a certificate with its own expiry date, and a wildcard still has one date that must renew. Give every hostname that serves HTTPS its own certificate monitor: one forgotten API certificate is enough to break an app while the website itself looks perfectly healthy.
Do the same for the domain
Domains expire too, and the consequences are worse: e-mail stops, DNS vanishes, and a domain that enters pending delete can be lost. The domain monitor reads expiry, registrar and status straight from the registry (RDAP) and warns 30 days ahead. It is included in every plan, including Free – because nobody should lose a domain to a forgotten invoice.
