Skip to content

SSL certificate monitoring

An expired TLS certificate is downtime by another name: the server is running, but every browser greets visitors with a security warning most will not click through. It's also entirely preventable — expiry dates are known long in advance. UpAll therefore treats certificates as part of monitoring, automatically.

How it works

If an HTTP monitor's target starts with https://, UpAll reads the TLS certificate the site serves about once an hour — no separate monitor, no setting to enable. Two conditions open incidents:

  • Expiring within 30 days → an Info incident opens. This is the early warning: everything still works, and you have up to a month to renew.
  • Expired or unreadable → a Degraded incident opens. The certificate is now a live problem — either past its expiry date or impossible to read at all.

Like every incident, opening and resolving emails all active workspace staff. And the incidents close themselves: each auto-resolves when it's superseded or the problem is fixed — renew the certificate and, once the new one is being served, the open incident resolves without anyone clicking anything. See certificate incidents for how they appear alongside the rest.

Where the warnings appear

  • The monitor's page shows the certificate's expiry, so a glance at any HTTPS monitor includes its certificate runway.
  • The live status wall carries an SSL attention strip — the certificates that need attention, in front of the whole team every time anyone looks at the wall (the live status wall).

Certificate incidents stay internal

Certificate incidents are always internal — they are never attributed to a client, even when the monitor belongs to a client's site. They alert your staff and appear in your console, but they don't show up among the client's incidents in their portal or reports.

The reasoning: an approaching expiry is operational upkeep for you to handle, not a service failure to announce. Handled inside the 30-day window, the client never experiences anything — so nothing is reported to them. The strip and the incident name the monitor and its site, keeping the attribution on your side of the fence.

Making the window count

Thirty days is enough to renew any certificate, but only if the warning is acted on. Treat the Info incident as a ticket, not a notice: assign it, renew, and let the auto-resolution confirm the fix — the incident closing is your proof that the new certificate is actually being served, which catches the classic mistake of renewing but forgetting to deploy. For background on how certificates work and why expiry bites so hard, see SSL/TLS certificates explained and certificate expiry risks.