SSL monitoring
SSL certificate expiry monitoring for every client site
Pingtier opens as a free beta soon. Free during beta. Then EUR 4 per client a month, excl. VAT.
When a certificate expires, browsers show a full-page warning and visitors leave. Usually the client sees it before you do. Pingtier checks the certificate on every HTTPS monitor and tells you weeks before expiry. It also tells you whose site it is.
What Pingtier checks on each certificate
Each HTTPS monitor checks three things:
- Expiry. The date when the certificate stops being valid.
- Chain. Whether the server sends a chain that a client can verify up to a trusted root.
- Hostname. Whether the certificate covers the hostname that you monitor.
A certificate that fails validation fails the check. Pingtier handles it like any other failure. At least 2 probes on different providers must confirm it. Then an outage opens, and Slack and email alerts go out at once.
When you hear about an expiring certificate
SSL expiry monitoring should warn you early, but it should not flood your inbox.
- Notices at 30, 14 and 7 days before the certificate expires.
- One daily SSL digest at 08:00 in your organisation's time zone collects the notices. Pingtier sends it only on days that have a notice.
- An SSL issue opens at 14 days or less. It appears on the Today list. There you can acknowledge, assign or snooze it. It closes by itself when the certificate is renewed.
The first digest goes out at the next 08:00 after you set up. A notice exists only on its exact day. If you create your organisation after 08:00 on a notice day, you miss that notice, but the later notices still arrive.
For a step-by-step method without any tool, read our guide on how to monitor SSL certificate expiry.
Every certificate belongs to a client
You add hostnames under a client. You can add one hostname or paste a list. Pingtier proposes the apex and www hostnames from DNS, and you select which ones to monitor. So an SSL issue always shows the client it belongs to. You do not have to look up who owns shop.example.net.
For outages, Pingtier writes a client message draft. You can copy it, open it in your email app, or mark the client as told. Pingtier never sends messages to your clients.
Uptime checks on the same monitor
The same monitor also checks HTTP(S) status, a keyword on the page and response time. You get uptime and certificate expiry monitoring for each client site in one place. See website monitoring for agencies or website and SSL monitoring for MSPs.
Checks run from 8 IPv4 probes on 4 providers in Europe, the US and Asia. Each monitor can pick its regions; all are selected by default. Read how Pingtier checks and how outage confirmation works.
Some sites use bot protection. If a bot challenge answers every probe, Pingtier shows the status Blocked, not Down. It sends you the probe IP addresses and the User-Agent to allow.
How other SSL monitoring tools handle expiry
Tools differ in when they warn you and on which plan. These facts come from each vendor's public pages, checked on 8 November 2026.
| Tool | Expiry notice timing | Notes |
|---|---|---|
| UptimeRobot | 30, 14 and 7 days before, and on the expiry day, by default. You can change the days. (source) | Its pricing data lists SSL monitoring on Solo, Team and Scale. (source) |
| StatusCake | Three alert days that you set. The product page names 1, 14 and 30 days. (source) | The free plan has 1 SSL monitor, checked every 24 hours. (source) |
| Better Stack | A lead time of 1, 2, 3, 7, 14, 30 or 60 days. (source) | Expiry is checked every hour (source). In the API, the expiry check is off by default (source). |
| Pingdom | By default, on the expiry day. You can set days in advance. | From that point the check is marked DOWN and other problems are not detected, so Pingdom recommends a separate check. (source) |
Full comparisons: Pingdom alternative, UptimeRobot alternative, StatusCake alternative, Better Stack alternative.
What Pingtier does not do
- It does not renew or install certificates.
- It does not monitor domain registration expiry.
- It does not find certificates for you from public certificate logs. You add the hostnames.
- It has no SMS or phone alerts and no status pages.
Free plan and pricing
The free plan covers 3 clients with 5 monitors each (15 per organisation), checked every 3 minutes, for one user. The certificate check is part of each HTTPS monitor, so it uses the same monitor limits.
After the beta, a paid client unlocks 30-second checks, the team and a year of history, with up to 10 enabled monitors per paid client. See pricing.
Free during beta. Then EUR 4 per client a month, excl. VAT.
FAQ
Does Pingtier renew my SSL certificates? No. Pingtier only checks certificates and warns you. Renewal stays with your host, your CDN or your ACME client.
Does Pingtier check domain registration expiry? No. Pingtier checks TLS certificates, not domain registrations.
Is SSL certificate monitoring included in the free plan? Yes. The certificate check is part of each HTTPS monitor. The free plan covers 3 clients with 5 monitors each, checked every 3 minutes, for one user.
When do I get expiry notices? At 30, 14 and 7 days before expiry, collected in one daily digest at 08:00 in your organisation's time zone. At 14 days or less, an SSL issue also opens on the Today list.
What happens if the chain is broken or the hostname does not match? The check fails. When at least 2 probes on different providers confirm the failure, an outage opens, and Slack and email alerts go out at once.
My client's site uses Cloudflare bot protection. Will it show as down? No. If a bot challenge answers every probe, Pingtier shows Blocked, not Down. It gives you the probe IP addresses and the User-Agent to allow.