What does an SSL check actually verify?
An SSL monitor opens a TLS connection to the host you name and inspects the certificate the server actually presents — not what a control panel says should be deployed. It records the subject, the issuer, the subject alternative names, the serial, the fingerprint and the chain, and it fails when the certificate has expired, does not match the hostname, or presents a chain that does not build to a trusted root.
The most common real-world failure is not expiry. It is a renewed leaf certificate deployed without its intermediate, which works in browsers that cache the intermediate from an earlier visit and fails for everyone else. A chain check catches that; a browser spot-check by a developer who has visited the site before usually does not.
How far ahead does it warn me?
You set the warning window per monitor with the SSL expiry alert days field, between 1 and 365 days. SSL-expiry alerting is off until you set it — the Quick Wizard pre-fills 30 days and the starter templates 21, and if you leave the field empty no certificate-expiry incident is opened. Once set, the monitor starts alerting when the certificate has fewer than that many days left, and keeps alerting on your normal notification policy until it is renewed.
Pick a window longer than your renewal process takes end to end, including the slowest approval in it. If a certificate needs a purchase order, 14 days is not enough; 45 is. Automated ACME renewals are usually fine at 14, because the value of the alert there is telling you the automation stopped.
How is domain expiry different from certificate expiry?
They fail differently and they are owned by different people. A certificate expiry breaks HTTPS and shows a browser interstitial; the site is still yours. A domain expiry takes the name away and can end with someone else holding it, which no amount of monitoring will undo.
Domain monitors read registry data over RDAP, falling back to WHOIS where a registry has not migrated. That data is third-party, cached, and sometimes rate-limited, so treat a domain expiry warning as informational: it is a prompt to check the registrar, not a measurement of your own systems. Set the domain expiry alert days generously — 60 days is a reasonable floor for anything that matters, because registrar transfers and payment-method failures are slow to resolve.
Do I need a separate monitor for each?
No, but it is usually worth it. A single HTTPS website monitor already reports certificate problems on the endpoint it checks. A dedicated SSL monitor is for the cases the website monitor cannot cover: a host that is not the one your site is served from (an API subdomain, a mail host, a load balancer), or a certificate you want a longer warning window on than the site check uses.
The Quick Wizard creates an endpoint check, an SSL check and a domain check together for a URL you paste, which is the shape most teams want.