Monitoring SSL certificate expiry for small business, dated and exact.

Most certificate renewals fail silently. The host logs say the renewal ran; the cert path says otherwise. By the time the warning bar lands at the top of a visitor's browser, the cert has been bad for some number of days and the visitors you have lost are not coming back. The right shape of monitoring is dated and exact; the right cadence is 90 / 30 / 7 / 1 days out; and the right cost depends on which certificate authority issued the cert in the first place.

What 90 / 30 / 7 / 1 days buys you

Ninety days out is the first chance to learn the renewal path has broken. Most managed hosts renew at thirty days out from expiry, so a 90-day alert is generous confirmation that the auto-renew ran cleanly. A 30-day alert is the deadline: if you have not heard from any platform by now, the renewal has not happened and you need to trigger it manually. A 7-day alert is the last warning before you risk some platforms refusing to renew at all. A 1-day alert is the "migrate before the browser warning page renders" email.

For the deeper walk through the tracked product surface, see the dedicated SSL expiry monitor page. The page covers how the daily check is engineered and what each tier ships.

What each CA charges for a re-issue

Let's Encrypt is the only certificate authority that issues domain-validated (DV) certificates for free. The auto-renew story on a managed host with Let's Encrypt is the most reliable in the category, but it is still subject to the "silent failure" failure mode your platform logs do not always surface. Mozilla's CA certificate policy wiki is the editorial reference for the broader policy context; Cloudflare's SSL documentation covers the operational surface for shops behind Cloudflare. The two together pin the textbook answer for managed shops.

DigiCert, Sectigo, and ZeroSSL all charge per-certificate on paid tiers. The per-certificate price is in the same order of magnitude as a domain registration; the surprise comes from the wildcard premium and the re-issue fee when a re-issue is needed before expiry. Most CAs reissue inside the validity period if you realize you have lost the private key. Cloudflare's engineering blog writes up the renewal flow for ACME-compatible CAs as the platform evolves.

The three habits that prevent a cert from getting old

First, the renewal reminder. The 90-day-out calendar reminder is the manual version of the monitor. It costs nothing and catches the same failures.

Second, the monthly hostname audit. Open the cert details in a browser every month and read the SAN list. If a hostname is in the cert that you have stopped serving, the cert is wider than it has to be; if a hostname is not in the cert that you are now serving, the visitor sees a name-mismatch error.

Third, the daily probe. SiteGuardian probes the cert path daily and emails you at 90 / 30 / 7 / 1 days out from expiry on every plan. The probe catches the silent failure the host logs do not surface. For the operational shape of the watch, see the SSL expiry monitor page.

What the habits do not cover

Mixed-content crawling. Domain expiration. CAA record mismatches. SHA-1 deprecation warnings. SiteGuardian probes the cert path and not the pages themselves; for mixed-content audits, you want a different tool — or the free URL audit on demand, which reads the redirect chain plus the cert chain.

The closest peer product with a broken-link crawler side of things is SiteGuardian versus Oh Dear. Oh Dear ships the broken-link crawler; SiteGuardian ships the loud-email-only shape. The two coexist for shops that want both.

If you would rather skip the habits

The 90-day-out calendar reminder takes fifteen minutes to set up; the monthly hostname audit takes one browser tab; the daily probe takes one URL. If you would skip all three, this article has done its job: the alternative is a browser-warning day that loses the trust you cannot invoice back.

For the smallest paid path, see SiteGuardian's pricing. The cert-expiry check is the same cadence on Starter, Pro, and Lifetime; the difference is the URL count and the uptime cadence.