SSL and domain expiry

This page explains the two expiry checks on HTTP, Keyword, and API monitors: the TLS certificate and the domain registration. Both expire on a known date, and both take everything down when they do.

#SSL certificate monitoring

Turn on Check SSL certificate for any https monitor and it does two jobs.

Clearer failures. A certificate problem normally surfaces as a bare connection error, indistinguishable from a dead host. With the check on, UptimeX probes plain TCP to the same port when a secure check fails. If the port answers but TLS did not, the failure is recorded as SSL certificate problem instead of Couldn't connect.

Expiry warnings. About once a day, separately from your regular checks, UptimeX reads the certificate's expiry date. When the certificate is within 14 days of expiring, a push notification lands on the devices the project's owner is signed in to: SSL certificate expires in 9 days, then expires today, then has expired. You are warned once per expiry date. Renew the certificate and the new date re-arms the warning.

The expiry date is read with a TLS 1.2 handshake. A server that only accepts TLS 1.3 does not report a date, and its card stays at Waiting for the first check.

#Domain expiry monitoring

Turn on Check domain expiry for any monitor whose target has a registrable domain. UptimeX looks the registration up over RDAP about once a day and warns the same way, once per expiry date, from 14 days out: Domain registration expires in 3 days.

An expired domain is the total outage: the site, the API, and your email stop resolving at once, and recovery can take days if the registrar puts the name in redemption. It is also the easiest outage to prevent.

#Turning them on

Both are toggles under Advanced settings when you create a monitor, and in Monitor settings afterwards. Changing the monitor's URL clears both dates, and they are looked up again within a day. Turning the domain check off and on forces an immediate lookup.

The warnings are push notifications only. They do not go to Slack, Discord, webhook, or email channels. Two account-wide switches control them, Certificate expiry and Domain expiry, under Notification settings on a project's Notifications page.

#Reading the cards

The monitor page shows a TLS certificate card and a Domain card. Each shows the days left: red at 7 days or fewer, amber at 30 or fewer, green otherwise, then Expires today and Expired N days ago. A card reads Not monitored until its check is on, and Waiting for the first check until the first lookup completes.

Treat the first warning as the moment to file the ticket. Fourteen days is enough to renew anything, as long as the first day is not wasted.

#What's next?

• Notification channels: where the account-wide expiry switches live.
• Create a monitor: the Advanced settings section.