D3bris Monitoring TLS/SSL certificates: expiry, name mismatch and warnings
Why TLS certificates expire despite auto-renewal, which errors trigger browser warnings, and how to monitor the certificates of your client websites.
An expired or wrong TLS certificate (still often called an SSL certificate) is one of the most visible problems a website can have. Instead of the site, the browser shows a full-page warning such as “Your connection is not private”. Most visitors stop right there – and many clients assume their website has been “hacked”.
Why certificates expire despite automatic renewal
Most hosts renew free certificates (for example from Let’s Encrypt) automatically. Renewals still fail regularly:
- The domain no longer points to the server that renews it. After a move, a DNS change or putting a CDN in front, the certificate authority’s validation can fail.
- A subdomain was forgotten. The certificate covers
client.combut notwww.client.comorshop.client.com. - Manually purchased certificates. One- or two-year certificates are renewed by hand – and the reminder went to an address nobody reads anymore.
- Shorter lifetimes. The industry is reducing the maximum validity of public certificates step by step. The more often certificates are renewed, the more an independent check matters.
The most common certificate errors
| Error | What it means | Typical cause |
|---|---|---|
| Expired | The validity date has passed | Automatic renewal failed or manual renewal forgotten |
| Name mismatch | The certificate was issued for a different name | New subdomain, wrong certificate after a move, the host’s default certificate |
| Invalid or untrusted | The chain to a recognised certificate authority is missing or broken | Intermediate certificate not installed, self-signed certificate |
All three are clearly detectable from the outside: a monitoring service establishes the same encrypted connection as a browser and validates the certificate along the way.
How D3bris checks certificates
On every check of an https:// address – that is, every 5 minutes – D3bris validates the certificate the way a browser does:
- Invalid, expired or issued for another domain: the page counts as failing. Once a second check confirms it, you get an email with the specific cause, e.g. “The TLS certificate does not match the domain”.
- Expires in 14 days or less: you get a warning with the expiry date – enough time to find the cause before visitors notice anything.
- In the overview: for every checked page you can see until when the current certificate is valid.
For websites with several subdomains, check one page per subdomain, as each subdomain can have its own certificate. In D3bris a subdomain is a website of its own.
What to do when you get a warning
- Check the expiry date and issuer in the browser via the padlock next to the address.
- Look at the host’s settings to see whether automatic renewal is active and whether it reports errors.
- Check DNS: do the domain and
wwwstill point to the server that issues the certificate? - Wait after renewing: D3bris checks again within 5 minutes and reports the recovery.
Limits
D3bris evaluates the certificate our check server sees. Other services on the same domain, such as a mail server, are not checked. We don’t grade settings such as outdated TLS versions or weak ciphers; specialised analysis tools exist for that.
More checks around domains, DNS and certificates are in the checklist for agencies.