Catch expiring certificates before the browser warning.

Expired certificates take sites down as surely as crashed servers. UptimeStatus watches every certificate and warns you at 30, 14, 7, and 1 days out.

The certificate renewed itself. Until it didn't.

Auto-renewal fails quietly: a DNS challenge breaks, a rate limit hits, a cron job dies on a server nobody logs into anymore. The certificate keeps working right up to the day it does not.

UptimeStatus checks the certificate your server actually presents: issuer, subject, validity window, and SHA-256 fingerprint, recorded on every check so the whole history is there when you need it.

yourcompany.com Valid
Expires in 84 days
Sep 26, 2026
checked 2m ago
Issuer
Let's Encrypt
CN=yourcompany.com
SHA-256 fingerprint
9F:2A:6C:...:B4:C4
unchanged

Four warnings, then an incident.

Your channels get a warning at 30, 14, 7, and 1 day before expiry, one notification per threshold. Early enough to fix a broken renewal, not so noisy that you learn to ignore it.

If the certificate expires anyway, an incident opens with the day count. If the TLS handshake fails outright, the monitor is marked down and the incident carries the exact error the probe saw.

shop.yourcompany.com Expires in 7 days
30 days before expiry
first warning
14 days, 7 days, 1 day
escalating warnings
Expired
incident opened

What SSL monitoring includes.

Certificates as code.

An ssl monitor is one API call. Create one for every hostname in your deploy pipeline, and nothing ships without a watched certificate.

Everything in the dashboard sits on the same API, so anything you can click, you can automate.

curl -X POST https://uptime-status.org/api/monitors \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Storefront certificate",
    "url": "https://shop.yourcompany.com",
    "type": "ssl"
  }'

Open source, MIT licensed.

The SSL check is one small, readable job in the repo. Use the hosted version, or run the whole thing on your own infrastructure with the same code and no feature gates.

git clone https://github.com/stacksjs/status
FAQ

SSL monitoring, answered.

How far in advance am I warned about expiry?

At 30, 14, 7, and 1 day before the certificate expires, a warning notification goes to the channels attached to the monitor, once per threshold. If the certificate expires anyway, an incident opens that says exactly how many days ago it lapsed.

What exactly does the check look at?

It opens a TLS connection to your hostname and reads the certificate your server presents: issuer, subject, the validity window, and the SHA-256 fingerprint. Every check stores a record, so you get a history, not just a current state.

Will I know when a certificate is renewed?

Yes. The fingerprint is compared against the previous check, so a renewal shows up as a fingerprint change. The same comparison catches certificates that were swapped when you did not expect it.

What happens if the TLS handshake fails entirely?

The monitor is marked down and an incident opens with the error message: connection refused, timeout, or no certificate returned by the peer. A certificate problem that breaks the handshake gets treated as seriously as downtime.

Does each certificate count as a monitor?

Yes, an ssl monitor is a regular monitor. The Free plan includes 5 monitors and Pro is $9/month for 100, so watching every hostname you own is rarely a capacity question.

Start monitoring in under 2 minutes.

No credit card required for the self-hosted, open-source version.