An expired certificate is the most embarrassing outage there is. Nothing is actually broken – the server is up, the database is fine – and yet every visitor sees a full-page red warning that your site "is not secure". Conversion drops to zero until someone notices.
"But we use Let's Encrypt, it renews itself"
Until it does not. The renewal cron job silently stops after a server migration. A firewall rule blocks the validation request. The DNS record for a subdomain changes and the wildcard stops validating. The certificate on the load balancer is not the one on the origin. Every team that has run websites for a few years has a story. Automation reduces the risk; it does not remove the need to watch.
Watch the certificate itself, not the renewal job
The only reliable signal is the one your visitors see: connect to the site over TLS and read the certificate that comes back. That catches every failure mode at once – wrong certificate deployed, chain incomplete, renewal never happened – regardless of which tool was supposed to renew it.
Warn early, alert on expiry
Ravnsight's certificate monitor records issuer, validity, days left and the chain on every check. Inside your warning window (14 days by default, adjustable per monitor) you get a warning once a day – not an incident, because nothing is down yet. An expired or invalid certificate is an outage and goes through normal confirmation and alerting.
Do the same for the domain
Domains expire too, and the consequences are worse: e-mail stops, DNS vanishes, and a domain that enters pending delete can be lost. The domain monitor reads expiry, registrar and status straight from the registry (RDAP) and warns 30 days ahead. It is included in every plan, including Free – because nobody should lose a domain to a forgotten invoice.
