An expired TLS certificate is unusual among outages: the server is up, the code is fine, and yet every browser shows a full-page security warning. It is also entirely predictable - the expiry date is written inside the certificate.
Why auto-renewal still fails
- A DNS or firewall change breaks the ACME challenge.
- The renewal job runs, but the web server is never reloaded.
- A certificate was issued manually for a subdomain and forgotten.
- The renewal email goes to someone who left the company.
What to monitor
Check more than the date. A good SSL monitor verifies the certificate chain is trusted, the hostname matches, the certificate is not yet-to-be-valid, and which TLS version is negotiated.
A sensible alert schedule
Upmonora alerts once at each threshold - 30, 14, 7 and 1 day by default - and resets automatically when the certificate is renewed. Thirty days gives time to fix automation; one day is the last call.
Because an expiring certificate is predictable, Upmonora also lowers the monitor's health score as expiry approaches, so it shows up in your AI insights before it becomes an incident.