---
title: "SSL certificate monitoring and expiry alerts · Fettle"
description: "SSL certificate monitoring: an alert days before a certificate expires, an incident when the chain or hostname breaks, and expiry dates in one list."
url: "https://fettle.sh/ssl-monitoring"
---

/ ssl monitoring

# SSL certificate monitoring that warns before a certificate expires

An SSL monitor connects to your host, reads its certificate and checks it the way a browser would. You hear about an expiry days before it happens, and about a broken chain or hostname the moment a check finds it, instead of from a visitor’s browser warning.

SSL monitors are on every plan, free included. The [SSL expiry monitoring guide](https://fettle.sh/use-cases/ssl-expiry-monitoring) walks through the setup, and the free [SSL checker](https://fettle.sh/tools/ssl-checker) reads a certificate once, without an account.

[Start free](https://fettle.sh/register)

Free plan: 20 monitors every 3 minutes from 1 region. No card.

## What an SSL monitor checks

- A warning before expiry

  Choose how many days ahead to hear about it, from 1 to 365; 14 unless you change it. Fettle checks the certificate on every probe, at the monitor's own interval, and a daily sweep sends the expiry warning once, when the certificate enters that window.

- Renewals re-arm it

  When the certificate is renewed, the warning re-arms for the new one, so each certificate warns you once, not every day.

- Broken certificates

  An expired certificate, a chain that does not verify or a hostname that does not match marks the monitor down, opens an incident and alerts you.

- Expiring soon, still working

  With less than 14 days left, the monitor shows as degraded: it still counts as up, but it stands out on the dashboard.

- Every expiry in one list

  Sort your monitors by certificate expiry, soonest first, in the dashboard, the [API](https://fettle.sh/api) or the [MCP server](https://fettle.sh/mcp), so “which certificates expire this month” is one question for your agent.

- Any port

  Port 443 by default, or the port your mail server, database proxy or internal API listens on.

## Where the warning goes

The expiry warning and incident alerts go to the monitor’s channels: email and Telegram on every plan, and Slack, Discord or a webhook from Plus. A [webhook](https://fettle.sh/docs/webhooks) delivery carries the days left, the expiry date, the issuer and the subject, so a script can open a ticket or start a renewal.

## Plans

An SSL monitor is a monitor like any other, checked from one region on the interval you pick. The free plan covers 20 monitors every 3 minutes from 1 region, SSL ones included. Every plan and limit is on the [pricing page](https://fettle.sh/pricing).

## Read next

- [How to catch SSL certificate expiry before it hurts Renewal is automated and mostly works, which is exactly why nobody notices when it quietly stops. Here is what to monitor and how to get warned early.](https://fettle.sh/use-cases/ssl-expiry-monitoring)
- [SSL certificate checker Check any domain's SSL certificate for free: issuer, validity window, days until expiry and the full chain, with no sign-up and nothing to install.](https://fettle.sh/tools/ssl-checker)
- [Cron job monitoring with heartbeat pings Cron job monitoring with heartbeats: each job pings a URL when it finishes, and Fettle alerts you when a run is late or reports a failure.](https://fettle.sh/heartbeat-monitoring)
- [Status page that updates from your monitors A hosted status page fed by your uptime monitors: live component status, daily uptime, incidents that open on their own, and email updates for subscribers.](https://fettle.sh/status-page)

[Start free](https://fettle.sh/register)

Free plan: 20 monitors every 3 minutes from 1 region. No card.