A checklist for keeping your SSL certificate healthy

HTTPS depends on a certificate that is valid for the hostname your users access. An expired certificate can interrupt access even when the application itself is running normally.

Certificate monitoring complements availability checks: it gives your team a chance to investigate a renewal problem before the expiration date.

Know which hostnames you serve

List your public domains and relevant subdomains. Check the exact hostname, including whether users connect with or without www.

A valid certificate on one hostname does not necessarily cover another. Review your CDN, reverse proxy and origin separately when they use different certificates.

Check renewal before expiration

Confirm which system renews the certificate and who owns it. Automatic renewal can fail because of a DNS change, validation problem or configuration change.

• Verify the expiration date currently presented to clients.
• Confirm that domain validation still works.
• Leave enough time to investigate and retry a failed renewal.

Verify the deployed certificate

Issuing a new certificate is only one step. The server must actually serve it, along with the expected intermediate certificates.

After a renewal, check the public endpoint again. Test every relevant hostname and confirm that the certificate chain is trusted by the clients you support.

Keep a short recovery procedure

Document the renewal owner, configuration location and verification steps. Keep private keys and credentials out of the document and out of incident updates.

Pair these checks with website monitoring, so a certificate problem and an application outage both have a clear response path.