SSL certificate checker: expiry, trust, and how to monitor one

“Check my SSL certificate” usually means one of three questions: when does it expire, who signed it, and will a browser trust it. An SSL certificate checker answers those for the certificate a server presents right now. It does not renew anything, and it will not email you in three weeks unless you add a monitor that does.

SSL-Zertifikat prüfen: what the handshake shows

The free checker on this site opens a TLS connection and stops there. It works for hosts that speak TLS but not HTTP — a mail server, a database, a custom port — because it never sends an HTTP request. You give it a hostname and, if you need it, a port; the default is 443. It reports issuer, subject, validity dates, fingerprint, protocol, the names the certificate covers, whether it is expired, and whether the chain is trusted.

curl -fsS https://api.hypermonitors.com/v1/tools/tls \
  -H 'content-type: application/json' \
  -d '{"host":"example.com","port":443}'

Public hostnames only. Private and internal addresses are refused. The endpoint is rate-limited. A trusted result means the chain verified at check time; it is not a promise about every browser, and it is not a vulnerability scan.

Check SSL expiry is not the same as “trusted”

A certificate can be inside its dates and still be rejected. Typical reasons: it is self-signed, the server did not send an intermediate, or the name on the certificate is not the name you connected to. A missing intermediate is the one that varies by client — one browser has the intermediate cached, another does not, and only one of them shows an error.

Expiry is the predictable failure. Let’s Encrypt and the other automated issuers renew about 30 days before the end date, so a certificate inside 14 days usually means renewal has already stopped. The reasons are ordinary: a DNS record changed, a firewall rule, an expired API token, a full disk. The certificate looks healthy until the morning it is not.

SSL-Zertifikat überwachen, statt jedes Mal von Hand zu prüfen

A checker tells you about today. Monitoring is a paid feature: the free plan does not include SSL alerts. On Solo and above, an HTTP monitor can watch the certificate of its URL (on by default once the plan allows it), or you can add a dedicated SSL monitor. The warning window defaults to 14 days and can be set from 1 to 90.

Reminders fire once per stage, and only for stages that fall inside the window you set. The stages are 30, 14, 7, 3 and 1 day. Leave the default at 14 and you get 14, 7, 3 and 1. Raise it to 30 and the 30-day reminder is included. Set it to 7 and the earlier stages never existed for that monitor. The same ladder is how “check SSL expiry” becomes an alert instead of a calendar entry.

Route the reminder somewhere you read ahead of time. Email suits a date that is days away; a chat channel suits the last few days, when someone has to act. SMS is a poor fit for a warning you can see coming, and it is not on the free plan anyway.