How to Effectively Monitor SSL/TLS Certificates and Avoid Unplanned Downtime

Published on December 29, 2024 by CrtMgr Team • 8 min read

SSL TLS Monitoring Automation Let's Encrypt ACME Management

Expired SSL/TLS certificates are one of the most common causes of unplanned outages for web applications. According to research, even large organizations fall victim to this problem, losing user trust and generating financial losses. In this article, we present a comprehensive guide to SSL/TLS certificate monitoring and automation of certificate management processes.

Why Certificate Monitoring is Critical

Consequences of Expired Certificates

When an SSL/TLS certificate expires, serious consequences follow:

Browser warnings: Users see frightening warnings about insecure connections
Traffic loss: 70-80% of users abandon the site after seeing a warning
Financial losses: For e-commerce, this means direct sales losses
Reputation damage: Loss of customer and business partner trust
API problems: Broken integrations with mobile apps and external services
SEO issues: Google lowers rankings for sites with expired certificates

Real-World Cases

Many well-known companies have experienced problems with expired certificates:

Microsoft Teams - outage caused by expired certificate (2023)
LinkedIn - partial service disruption (2022)
Spotify - user login problems (2022)

Even the largest organizations with advanced DevOps teams can fall victim to this problem if they don’t have an adequate monitoring system.

Fundamentals of Certificate Monitoring

What to Monitor

An effective monitoring system should track:

Certificate expiration date
- Primary indicator requiring immediate attention
- Monitor certificates at least 30 days before expiration
Certificate chain status
- Main certificate
- Intermediate certificates
- Root CA certificate
TLS protocol configuration
- Supported TLS versions (minimum TLS 1.2)
- Cipher suites
- Secure renegotiation
Certificate details
- Common Name (CN)
- Subject Alternative Names (SAN)
- Certificate type (DV, OV, EV)
- Issuer (Certificate Authority)
Certificate integrity
- Fingerprint
- Serial number
- Signature verification

Monitoring Frequency

Recommended certificate checking intervals:

Production environments: Every 6-12 hours
Critical environments: Every 1-4 hours
Development environments: Every 24 hours
After infrastructure changes: Immediately

Alerting Strategy

Multi-Level Notification System

An effective alerting system should send notifications at different levels:

Level 1: Early Warning (30 days before expiration)

Goal: Planned certificate renewal
Recipients: DevOps team, administrators
Channel: Email, Slack
Priority: Informational

Level 2: Urgent Reminder (14 days before expiration)

Goal: Accelerate renewal process
Recipients: DevOps team, IT managers
Channel: Email, Slack, SMS
Priority: High

Level 3: Critical Warning (7 days before expiration)

Goal: Problem escalation
Recipients: DevOps team, IT managers, executives
Channel: Email, SMS, phone
Priority: Critical

Level 4: Emergency Alert (1 day before expiration)

Goal: Immediate action
Recipients: All stakeholders
Channel: All available channels
Priority: Emergency

Notification Channels

Email

Primary channel for all alerts
Built-in documentation and context
Notification archive

Slack/Microsoft Teams

Integration with team tools
Quick team response
Discussion and coordination capabilities

SMS

For high-priority alerts
Guaranteed delivery
24/7 availability

PagerDuty/Opsgenie

Professional on-call systems
Escalation and duty rotation
Integration with incident management processes

Webhook/API

Automation and custom integrations
SIEM and monitoring systems
Chatbots and automatic responses

Certificate Renewal Automation

Let’s Encrypt and ACME Protocol

Let’s Encrypt is a free, automated, and open Certificate Authority (CA) that has revolutionized the way SSL/TLS certificates are managed.

Let’s Encrypt advantages:

Completely free certificates
Automatic renewals
Short lifetime (90 days) enforces automation
Wildcard certificate support
Multi-domain (SAN) support

Automation tools:

Certbot

# Installation (Ubuntu/Debian)
sudo apt-get install certbot

# Obtain certificate for nginx
sudo certbot --nginx -d example.com -d www.example.com

# Automatic renewal (cron)
0 0,12 * * * certbot renew --quiet

acme.sh

# Installation
curl https://get.acme.sh | sh

# Obtain certificate with DNS challenge
acme.sh --issue --dns dns_cf -d example.com -d *.example.com

# Automatic renewal
acme.sh --cron

Traefik

# Automatic Let's Encrypt integration
[certificatesResolvers.myresolver.acme]
  email = "[email protected]"
  storage = "acme.json"
  [certificatesResolvers.myresolver.acme.httpChallenge]
    entryPoint = "web"

ACME Challenges

ACME protocol offers different domain ownership verification methods:

HTTP-01 Challenge

Simplest method
Requires HTTP access on port 80
Doesn’t work behind firewall or with wildcard

DNS-01 Challenge

Supports wildcard certificates
Requires DNS management API
More secure for isolated environments

TLS-ALPN-01 Challenge

Verification through TLS
Works on port 443
Doesn’t require port 80

Certificate Management Best Practices

1. Centralized Management

Certificate inventory

Maintain a registry of all certificates
Document locations and owners
Track expiration dates

Helpful tools:

CrtMgr - certificate monitoring and management
Vault - certificate storage and rotation
cert-manager - automation in Kubernetes

2. Process Automation

# Example certificate checking script
#!/bin/bash
DOMAIN="example.com"
EXPIRY_DATE=$(echo | openssl s_client -servername $DOMAIN -connect $DOMAIN:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)

# Note: date -d works on Linux (GNU coreutils)
# On macOS/BSD use: date -j -f "%b %d %H:%M:%S %Y %Z" "$EXPIRY_DATE" +%s
EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s)
CURRENT_EPOCH=$(date +%s)
DAYS_LEFT=$(( ($EXPIRY_EPOCH - $CURRENT_EPOCH) / 86400 ))

if [ $DAYS_LEFT -lt 30 ]; then
    echo "ALERT: Certificate for $DOMAIN expires in $DAYS_LEFT days!"
fi

3. Private Key Security

Storage:

Encryption at rest
Access control (chmod 600)
Hardware Security Modules (HSM) for critical certificates

Management:

Regular key rotation
Different keys for different environments
Backup and disaster recovery

4. Testing and Validation

After certificate deployment:

# Check certificate chain
openssl s_client -connect example.com:443 -showcerts

# Test TLS configuration
testssl.sh https://example.com

# SSL Labs test
curl https://api.ssllabs.com/api/v3/analyze?host=example.com

5. Documentation and Procedures

Document:

Certificate obtaining process
Renewal procedures
Emergency procedures
CA contacts
Key and certificate locations

6. Multi-Environment Strategy

Environments:

Development: Self-signed or internal CA
Staging: Let’s Encrypt or cheaper certificates
Production: Commercial certificates or Let’s Encrypt

Benefits:

Cost savings
Realistic testing
Problem isolation

Practical Monitoring with CrtMgr

Monitoring Configuration

CrtMgr offers a simple and effective solution for SSL/TLS certificate monitoring:

1. Adding a domain

Domain: example.com
Public access: Yes/No
Extra scans: Yes/No

2. Alert configuration

30 days before expiration
14 days before expiration
7 days before expiration
1 day before expiration

3. Automatic scanning

Daily certificate checks
Automatic change detection
Scan history

4. Public sharing

Generate public links
Monitoring without login
Dashboard integration

Integrations

API Integration

# Check status via API
curl https://crtmgr.com/api/sites/1

# Automatic scanning
curl -X POST https://crtmgr.com/api/sites/1/scan

Crisis Situation Handling

Scenario 1: Certificate Expired

Immediate actions:

Problem verification

echo | openssl s_client -connect example.com:443 2>&1 | grep "Verify return code"

Communication

Notify team and stakeholders
Set status page (if available)
Prepare user communication

Quick solution

# Obtain new certificate (Let's Encrypt)
sudo certbot certonly --webroot -w /var/www/html -d example.com

# Install certificate
sudo cp /etc/letsencrypt/live/example.com/fullchain.pem /etc/nginx/ssl/
sudo cp /etc/letsencrypt/live/example.com/privkey.pem /etc/nginx/ssl/

# Restart server
sudo systemctl reload nginx

Verification

# Check new certificate
curl -I https://example.com
openssl s_client -connect example.com:443 < /dev/null 2>&1 | grep "Verify return code"

Scenario 2: Certificate Chain Issues

Symptoms:

Some browsers show warnings
Old devices have connection problems
SSL Labs shows “Chain issues”

Solution:

# Download full chain
wget https://letsencrypt.org/certs/lets-encrypt-r3.pem

# Create full chain
cat domain.crt intermediate.crt > fullchain.crt

# Configure in nginx
ssl_certificate /path/to/fullchain.crt;
ssl_certificate_key /path/to/private.key;

Scenario 3: Wildcard Certificate Renewal

For wildcard certificates, DNS verification is required:

# acme.sh with Cloudflare
export CF_Token="your-cloudflare-api-token"
acme.sh --issue --dns dns_cf -d example.com -d *.example.com

# Certbot with Route53
sudo certbot certonly \
  --dns-route53 \
  -d example.com \
  -d *.example.com

Metrics and KPIs

Metrics to Track

Days to Expiry
- Average for all certificates
- Minimum (closest expiration)
- Number of certificates < 30 days
Automation Rate
- % of certificates renewed automatically
- Target: >95%
Mean Time to Resolve (MTTR)
- Average time to resolve certificate issues
- Target: <1 hour
Incidents
- Number of certificate-related incidents
- Target: 0 per quarter
Certificate Coverage
- % of domains with valid certificates
- Target: 100%

Monitoring Dashboard

┌─────────────────────────────────────────┐
│  SSL/TLS Certificate Dashboard          │
├─────────────────────────────────────────┤
│  Total Certificates: 156                │
│  Expiring in 30 days: 12                │
│  Expiring in 7 days: 2                  │
│  Expired: 0                             │
├─────────────────────────────────────────┤
│  Automation Rate: 97%                   │
│  Avg Days to Expiry: 45                 │
│  MTTR: 0.5 hours                        │
└─────────────────────────────────────────┘

Tools and Resources

Monitoring Tools

Open Source:

CrtMgr - Comprehensive certificate management
cert-manager - Kubernetes automation
SSL Checker - Basic online monitoring

Commercial:

DigiCert CertCentral - Enterprise certificate management
Sectigo Certificate Manager - Large-scale management
GlobalSign - Advanced management tools

CLI Tools

# OpenSSL - certificate checking
openssl s_client -connect example.com:443 -showcerts

# Testssl.sh - comprehensive test
testssl.sh https://example.com

# Nmap - SSL port scanning
nmap --script ssl-cert -p 443 example.com

# Zgrab - bulk scanning
zgrab2 tls --port=443 --input-file=domains.txt

Online Tools

SSL Labs (ssllabs.com) - Best SSL/TLS configuration test
CertificateMonitor - Expiration monitoring
WhyNoPadlock - Mixed content debugging

Summary

Effective SSL/TLS certificate monitoring is not a luxury, but a necessity in today’s digital environment. Key takeaways:

Automation is key - Manual certificate management doesn’t scale and leads to errors
Multi-level alerting - Notification system must be redundant and escalate issues
Proactive approach - Monitor 30+ days before expiration, don’t wait until the last moment
Documentation and procedures - Everyone on the team should know what to do in a crisis
Regular testing - Test disaster recovery scenarios at least quarterly

Start Today

Don’t wait for the first incident. Implement certificate monitoring today:

Inventory all certificates in your organization
Deploy a monitoring system (e.g., CrtMgr)
Configure renewal automation with Let’s Encrypt
Set up multi-level alerts
Document procedures and train the team

SSL/TLS certificate monitoring is an investment that pays back many times over by avoiding downtime, maintaining customer trust, and providing peace of mind for the DevOps team.

Need a simple certificate monitoring solution? Try CrtMgr - a free tool for SSL/TLS certificate monitoring with automatic alerts and public links to share certificate status.

Start monitoring certificates →

CrtMgr Blog - SSL/TLS Certificate Management Insights