Why an expired certificate is an outage
When a TLS certificate expires, browsers stop trusting the connection and show a full-page security warning instead of your site. To a visitor that is indistinguishable from a hack, and there is no graceful degradation: the moment the clock passes the expiry date, every user is blocked. Because the certificate was valid yesterday and the change is purely time-based, nothing in your application logs warns you in advance.
These outages are common precisely because they feel like they should be automatic. A renewal job that quietly failed weeks ago only becomes visible at the exact moment it is most expensive.
How certificate monitoring works
A certificate monitor connects to your host over TLS, reads the certificate the server presents, and tracks how many days remain until it expires. When that number drops below a threshold you set, it alerts you — while there is still time to renew. PageLantern tracks days remaining on the certificate and warns before it lapses, and can watch domain registration expiry in the same monitor set.
The check runs from outside, so it sees the certificate exactly as your users' browsers do, including whether the server is actually serving the renewed certificate rather than an old one still cached on a load balancer.
How much warning to configure
Give yourself enough lead time to fix a failed renewal during business hours, not at 2 a.m. on a weekend. A common pattern is a first warning around 30 days out and a more urgent one at 7 days, which leaves room to investigate a stuck automated renewal, request a replacement, and deploy it across every host and CDN edge.
Set the threshold to the worst realistic case for your environment. If a certificate has to propagate to several edge locations, count that time in your warning window.
Short-lived certificates and automated renewal
Automated issuers such as Let's Encrypt use short-lived certificates — 90 days is typical — that are meant to renew automatically. Automation reduces manual work but does not remove the failure mode: a renewal can silently break when a validation record changes, a rate limit is hit, or a cron job stops running. Monitoring is what tells you the automation failed while you still have days of runway.
The industry is moving toward even shorter certificate lifetimes, which makes silent renewal failures more frequent, not less. Continuous expiry monitoring is the backstop that catches them regardless of who or what was supposed to renew.
Beyond expiry: the whole handshake
Expiry is the most common failure, but not the only one. A missing intermediate certificate, a hostname mismatch, or a certificate served for the wrong domain will also break the handshake. Pair certificate monitoring with an HTTP check that verifies the page actually loads over https, and with DNS and domain-expiry monitoring, so the whole chain that has to work for a secure connection is watched, not just one link.