SSL monitoring
Certificate expiry, trust and renewals, with reminders timed to how each renews.
SSL monitoring watches the certificate each of your hostnames presents, and tells you before it expires and the moment browsers stop trusting it. An expired certificate takes a site down for every visitor as surely as a crashed server, and most now renew themselves, so the one time it matters is the time automatic renewal quietly broke.
Adding a certificate
Choose Watch a certificate and enter a hostname: onbixo.com,
or with a port, api.onbixo.com:8443. Add each name you serve on its own,
since www., app. and api. can each carry their own
certificate. The first check runs straight away and the row fills in a moment later.
The free SSL Checker has a button that adds the host
it just graded.
What each check reads
| Check | What it means |
|---|---|
| Expiry | Days left, and the date. Inside the reminder window the status reads Expiring. |
| Trust | Whether the certificate leads back to an authority browsers trust. A server that sends it without its intermediate is caught here. |
| Name | Whether the certificate covers the hostname. A wildcard covers one label: *.onbixo.com covers www.onbixo.com but not onbixo.com. |
| Strength | Self-signed, SHA-1 signatures and keys shorter than 2048-bit RSA are problems. |
| Grade | Pro and Agency: A+ to F from the TLS versions accepted and HSTS, as on the SSL Checker. |
Alerts
| Alert | Sent when | Plans |
|---|---|---|
| Expiring | 30, 14, 7, 3 and 1 days before expiry (14, 7 and 1 on Free) | All |
| Expired, not trusted, wrong name | A check finds it | All |
| Valid again | A broken certificate is fixed | All |
| Renewed, new issuer | The host presents a different certificate | Basic and up |
| Grade dropped | The grade falls, say A+ to B | Pro and Agency |
Reminders follow how the certificate renews. One applies only once less than 30% of the certificate's lifetime is left, so a 90-day Let's Encrypt certificate, which renews itself at about 30 days left, is first reminded at 14. Each alert is sent once per certificate, by email and in the notification bell; on Pro and Agency to everyone in the workspace, otherwise to its owner.
Plans
| Free | Basic | Pro | Agency | |
|---|---|---|---|---|
| Certificates | 1 | 3 | 10 | 30 |
| Checked | Daily | Every 12 hours | Every 6 hours | Every 6 hours |
| Grade on every check | No | No | Yes | Yes |
| Renewal history kept | Latest | Last 3 | All | All |