SSL Certificate Monitoring
FlareWarden automatically monitors SSL certificates for all HTTPS uptime monitors. Get alerts before certificates expire and when certificates change unexpectedly.
Automatic SSL Monitoring
You don't need to set up SSL monitoring separately. When you create an uptime monitor for an HTTPS URL, FlareWarden automatically tracks the SSL certificate.
What We Monitor
Comprehensive tracking of SSL certificate health and status
Certificate Expiration
Track when certificates expire and get alerts well before expiry to prevent browser security warnings.
Certificate Changes
Detect when certificates are renewed or replaced. Useful for catching unexpected changes.
Issuer Changes
Alert when the certificate authority changes. This could indicate a certificate swap.
Subject Information
Track changes to certificate subject (the domain name and organization info).
Expiry Warning Thresholds
Configure alerts at multiple intervals before certificate expiration
You'll receive alerts at multiple intervals before a certificate expires. Configure these thresholds in your preferences:
days
Warning
Early heads-up to plan renewal. Default: 30 days.
days
Urgent
Time to take action if auto-renewal hasn't kicked in. Default: 14 days.
days
Critical
Immediate action required. Default: 7 days.
Customize these thresholds in Settings → Preferences. A final notice goes out the day before expiry. A certificate that renews itself stays quiet until its renewal is overdue: the first warning waits until a quarter of its lifetime is left, so a 90-day certificate, which Let's Encrypt and most managed hosts renew at 30 days, first warns at 22.
SSL Notification Types
Configure which SSL events trigger notifications for each team member
Configure which SSL events trigger notifications for each team member:
| Event | Description |
|---|---|
| SSL Expiring | Certificate approaching expiration (at your configured thresholds) |
| SSL Expired | Certificate has expired (immediate alert) |
| Certificate Changed | Certificate was renewed or replaced |
| Issuer Changed | Certificate authority changed (e.g., Let's Encrypt → DigiCert) |
Certificate Transparency Discovery
The certificates issued for your domain, and the subdomains they name
Publicly trusted certificate authorities record every certificate they issue in public Certificate Transparency (CT) logs. FlareWarden reads those logs for each HTTPS site's domain once a week and lists the certificates and the subdomains they name on the site's SSL page. This helps you:
- Detect unauthorized certificates issued for your domain: an alert when one comes from an issuer you don't expect
- Discover subdomains you may not be monitoring yet
- Track certificate renewals on the subdomains you choose to track, with expiry alerts
How certificate alerts work
- The first read lists the issuers your domain uses today. They become its expected issuers, so certificates already issued never alert.
- After that, a certificate from any other issuer alerts once. Renewals from an expected issuer never do, even through another of its intermediates (Let's Encrypt's R10 and R11, for example).
- On the site's SSL page you can mark an issuer as expected, stop expecting one, also alert on certificates naming a host your domain had no certificate for, or turn the alerts off.
- Alerts go to members with Certificate Issuer Changed on in their notification settings, and to webhooks subscribed to
ssl.issued. They use no monitors from your plan.
Logs are read weekly, and CT search can take a while to show a new certificate, so an alert can arrive days after the certificate was issued. A certificate from an issuer you already expect, for a name your domain already has, doesn't alert. If you need alerts within minutes, or want to approve each certificate's key in advance, use a dedicated real-time CT monitor alongside FlareWarden. Subdomains are listed, not tracked, until you choose Track on one.
Webhook Events
SSL events trigger webhooks for integration with your tools
SSL events can also trigger webhooks for integration with your tools:
ssl.expiring - Certificate expiring soon
ssl.expired - Certificate has expired
ssl.changed - Certificate changed
ssl.issued - A certificate for your domain from an issuer you don't expect appeared in CT logs
Best Practices
- Use auto-renewal: Let's Encrypt and most providers offer automatic renewal
- Set generous thresholds: 30 days gives you time to renew a long-lived certificate by hand
- Monitor subdomains: Each subdomain needs its own certificate (unless using wildcards)
- Track certificate changes: Unexpected changes could indicate security issues