01
A full-page browser wall
The moment a certificate expires, Chrome, Safari and Firefox throw an interstitial security warning over your entire site. Visitors see red, not your homepage.
SSL / TLS Certificate Monitoring
PulseStack connects to your site on port 443 and reads the live TLS certificate your visitors are served, then warns you before it expires. One silent renewal failure is all it takes to replace your homepage with a full-page security warning. We make sure that day never arrives unannounced.
Free plan, no card required. SSL certificate monitors are included from the Starter plan at £9/mo.
Check any site's certificate below, or open the full SSL checker for chain trust, hostname and every name on the certificate.
Live TLS handshake - the same inspection PulseStack repeats around the clock.
The port we connect to on every check, reading the live TLS certificate your visitors are served.
Certificate facts shown in your dashboard: days remaining, expiry date, issuer and TLS protocol version.
SSL certificate monitors are checked up to once an hour, plenty for a date-based expiry.
Native alert channels, so the expiry warning reaches you where you already work.
When this breaks
A certificate does not fail loudly. It fails at a timestamp, and the internet decides your site is dangerous. Here is what that actually looks like.
The moment a certificate expires, Chrome, Safari and Firefox throw an interstitial security warning over your entire site. Visitors see red, not your homepage.
Nobody types a card number into a page the browser has flagged as unsafe. Checkout, sign-up and lead forms all collapse to zero while the cert is expired.
Most certs are set to renew automatically. Most of the time they do. The one time the renewal cron fails silently is the time you find out from a customer, not a dashboard.
A valid leaf certificate served without its intermediate still fails in many clients. It works in your browser and breaks for a segment of real users you never see.
What we inspect
We do not just ping the port. We complete the TLS handshake and read the certificate your server presents, so the expiry date we report is the one your users actually get.
We read the notAfter date and count down. You set a days-before-expiry threshold (7 days by default) and we alert you the moment it is crossed, not on the day it dies.
Who signed the certificate and when it expires, read on every check so you can see at a glance which certificate is live.
The TLS version your server negotiates, shown with the certificate details in your dashboard sidebar on Starter and above.
If the TLS handshake on port 443 fails, the monitor goes down and you are alerted, so a broken HTTPS setup is caught as well as an expiring one.
Set-up in minutes
Paste the domain you want watched. No agent, no DNS change, no code on your site.
Choose how many days before expiry you want to be warned. The default is 7 days, or pick a fortnight, a month, whatever suits your renewal flow.
Route the warning to email, Slack, Teams, PagerDuty or any of the eight native channels.
PulseStack re-checks the certificate up to once an hour and stays silent until something actually needs you.
Start on the free plan today and add SSL certificate monitors whenever you are ready. No card to begin.
Not just certificates
Certificate health sits alongside every other check your site needs. Watch the whole stack from a single account, including DNS record and domain expiry monitors, with HTTP and API checks supporting custom request headers.
Status codes, response time and content from any URL.
Confirm a word is present, or flag when one appears.
Timed TCP connection checks to any host and port.
Watch a specific service port stays open and answering.
Endpoint checks with custom request headers.
Cron and background jobs check in, or you get told.
Everything included
SSL monitoring is part of the same platform that runs your uptime checks, SEO monitoring and the Security Shield. Everything below comes as standard on the plans that include SSL certificate monitors.
The Security Shield, a separate subscription, adds ten light-touch security tests and grades your site from A to F, giving certificate health context within your wider security posture.
Eight native channels
A certificate alert is only useful if you see it in time. Route it to any of these, and an automatic re-check keeps the noise down.
SMS alerts are included on the Team and Enterprise plans.
An honest comparison
Two of them rely on you remembering. One of them does not.
Who it is for
You manage certificates you did not buy on domains you did not register. One expired cert on a client site is one angry phone call. Watch every hostname from a single account.
Auto-renewal is set up and mostly works. This is your independent second pair of eyes, catching the silent cron failure and routing it straight to PagerDuty.
No dedicated ops person, no time to remember renewal dates. Point PulseStack at your domain and let the days-before-expiry warning do the remembering for you.
Set a days-before-expiry threshold once and let PulseStack carry the reminder for you, on every check, across every channel.
Questions
SSL certificate monitoring regularly checks your website's TLS/SSL certificate so you hear about expiry or a broken certificate before visitors do. PulseStack™ connects to your server from outside your network, at most once an hour, and reads the certificate it presents. You are alerted when the certificate is within a set number of days of expiry (7 by default, adjustable per monitor), and straight away if it is invalid or the secure connection fails.
Browsers stop trusting the site at once. Chrome shows “Your connection is not private” with the error NET::ERR_CERT_DATE_INVALID, Firefox and Safari show similar full-page warnings, and most visitors leave. Apps and API clients refuse to connect, and search engine crawlers cannot fetch your pages over HTTPS. Nothing else about the site breaks: it works again as soon as a renewed certificate is installed, which is why an alert days before the expiry date is so valuable.
Certificates are issued for a fixed period so that keys are replaced and ownership is re-checked regularly. Under the CA/Browser Forum's ballot SC-081, publicly trusted certificates issued since 15 March 2026 can last at most 200 days, falling to 100 days from 15 March 2027 and 47 days from 15 March 2029. When a certificate expires, browsers show a full-page security warning instead of your site, so visitors, apps and search engine crawlers cannot reach it until a renewed certificate is installed.
An SSL certificate monitor alerts you when a certificate has expired or is within your chosen number of days of expiry, and straight away if the certificate is invalid or the secure connection to your server fails. For a deeper look at how TLS is set up on your server, Security Shield, a separate subscription, includes a TLS configuration test alongside nine other light-touch security tests.
Each SSL certificate monitor has an alert threshold in days, 7 by default, which you can change per monitor. When the certificate is within that many days of expiry, the monitor is marked down and an alert goes to the contacts you chose, followed by a recovery alert once a renewed certificate is in place. There is one threshold per monitor rather than a series of reminders, so pick a number that gives your team time to renew. Alerts can go to any of your contacts, such as email, Slack, SMS or PagerDuty.
Yes. An SSL certificate monitor checks whichever certificate your server presents for the hostname you enter, whether that is a wildcard certificate (*.example.com), a multi-domain SAN certificate or a single-domain certificate. Add a monitor for each hostname you serve, including subdomains, so each one's expiry is tracked.
A certificate chain is the trust hierarchy connecting your domain certificate to a root Certificate Authority that browsers recognise. The chain typically includes your leaf certificate, one or more intermediate certificates, and the root CA. If any link is missing or expired, browsers reject the entire connection, which is why it is worth checking the full chain whenever you install or renew a certificate.
TLS 1.0 and 1.1 have known vulnerabilities and are disabled by default in all major browsers since 2020. PCI DSS compliance requires TLS 1.2 as a minimum. If your server still accepts connections on deprecated protocols, it is vulnerable to downgrade attacks. Security Shield, a separate subscription, includes a TLS configuration test that reviews how your server's TLS is set up, so you can tighten it before it becomes a compliance issue.
Yes. When your site uses a CDN, PulseStack checks the certificate served by the CDN edge, which is what your visitors see. That makes it a useful external check on certificates your CDN issues and renews on your behalf.
Google uses HTTPS as a ranking signal and will deindex pages that return certificate errors. If search engine crawlers encounter an expired certificate during a crawl, your pages can drop out of search results. By monitoring certificates proactively and renewing before expiry, you prevent the SEO damage that comes from even a brief certificate-related outage.
Auto-renewal tools like Certbot and ACME clients fail more often than people expect. Common causes include expired DNS validation tokens, disabled cron jobs, blocked ports, changed server configurations, and rate limits from the certificate authority. PulseStack acts as an external safety net. Even if your internal renewal process reports success, PulseStack checks the certificate your server actually presents to visitors.
Yes. The quick checker at the top of this page and the full free SSL checker at pulsestack.co.uk/free-tools/ssl-checker need no account. Enter any domain to see the issuer, expiry date and days remaining, and the full checker also shows whether the chain is trusted and whether the certificate covers the name. For continuous certificate monitoring with automated alerts, SSL certificate monitors are included from the Starter plan, and every paid plan starts with a 14-day free trial with no card needed.
The maximum lifespan of a publicly trusted certificate fell from 398 days to 200 days on 15 March 2026, and it falls to 100 days on 15 March 2027 and 47 days on 15 March 2029, under CA/Browser Forum ballot SC-081. Certificates now need renewing at least twice a year, and soon far more often. Every renewal is a chance for automation to fail quietly, so an outside check of the certificate your server actually presents matters more each year, especially across dozens of domains.
Start free with no card, watch your first monitors in minutes, and add SSL certificate monitors from the Starter plan whenever you are ready. Annual billing saves 20%, and paid plans include a 14-day trial.