Why expiry still surprises teams
SSL certificates expire on a fixed date, but the failure mode is deferred. Browsers, mobile apps, and API clients only complain when a handshake fails - often after users already noticed.
What to watch
- Leaf certificate notAfter
- Intermediate chain changes
- Hostname mismatch on renewals
Calendar reminders help, yet they drift when domains are added or renewed early.
A short monitoring window before expiry turns a quiet date into an actionable alert.
Start with a free SSL check when you onboard a domain, then turn the same check into a monitor.
openssl s_client -connect example.com:443 -servername example.com