Catch expiring SSL certificates 15 days before they expire

Yes, WebPixie tracks SSL certificate status, expiration, chain validity, and TLS configuration for monitored sites. SSL monitoring runs daily checks that validate the full certificate chain from leaf to intermediate to root, verify cryptographic signatures, and inspect TLS version, cipher suite, key exchange, and key strength. WebPixie also surfaces Subject Alternative Names, OCSP and CRL endpoints, and Extended Key Usage OIDs; Certificate Transparency entries are available in the Certificates Manager. Expiration alerts are sent by default 15 days before a certificate expires, giving your team time to renew before visitors see browser warnings. SSL check failures and expiration events can create tracked incidents through incident management, depending on your plan. If you manage several domains or subdomains, use the Certificates Manager to review the CT-log inventory in one place.

Yes, WebPixie checks SSL certificates daily and sends expiration warnings by default 15 days before renewal is due. SSL monitoring validates the served certificate against the trusted root CAs, confirms it matches your hostname, and requires TLS 1.2 or higher, then reads the full chain, checks the expiration date, and surfaces details such as issuer, subject names, TLS version, cipher suite, and OCSP and CRL endpoints. Early warning matters because an expired certificate can trigger browser security warnings, block customer trust, and make checkout, login, or form submission feel unsafe. If a certificate check fails or expiration reaches an alert threshold, WebPixie can notify your team and, on supported plans, create an incident through incident management. Teams with several domains or subdomains can use the Certificates Manager to review CT-log inventory in one place.

WebPixie surfaces certificate validity, chain consistency, expiration, TLS configuration, and certificate identity details for each monitored site. SSL monitoring validates the served certificate against the trusted root CAs, confirms the hostname matches, and requires TLS 1.2 or higher; it then extracts the full certificate chain from leaf to intermediate to root and verifies cryptographic signatures for RSA, EC/ECDSA, Ed25519, and Ed448 certificates. It also reports TLS version, cipher suite, key exchange, key strength, Subject Alternative Names, OCSP and CRL endpoints, and Extended Key Usage OIDs. Expiration tracking is included, with default warnings 15 days before a certificate expires so teams have time to renew. SSL check failures and expiration events can create incidents through incident management, depending on your plan. Teams managing several domains can use the Certificates Manager to review Certificate Transparency inventory across domains and subdomains.

No. WebPixie monitors SSL certificates; it does not issue or renew them. Renewal stays with your certificate authority, such as Let’s Encrypt, your hosting provider, or another CA. The recommended workflow is automatic renewal at your CA paired with SSL monitoring to confirm the renewal actually happened. Daily revalidation catches the common failure where a Let’s Encrypt auto-renewal breaks silently and the original certificate keeps moving toward expiry. WebPixie sends an expiry warning 15 days before expiry by default, and a failed check can open a tracked incident through incident management on supported plans. Teams managing many certificates can review public CT-log inventory in the Certificates Manager.

Yes. WebPixie monitors both wildcard certificates, which cover *.example.com, and SAN certificates, which cover several specific domains under one certificate. On every daily check, SSL monitoring extracts the Subject Alternative Names and validates that each covered domain matches the certificate’s claims, alongside full chain validation and expiry tracking. This is useful for teams running many subdomains under a single wildcard or multi-brand certificates that list several domains. If you manage several certificates across domains and subdomains, the Certificates Manager gives you a CT-log inventory in one place, and a failed SSL check can open a tracked incident through incident management on supported plans.

Certificate Transparency (CT) is a public, append-only logging system that certificate authorities write to whenever they issue a certificate, so anyone can audit which certificates exist for a domain. It was created to catch mis-issuance: before CT, a certificate authority could issue a certificate for your domain, by mistake or after a compromise, and you might never find out. Because every issuance is now recorded in public logs, an unexpected certificate becomes visible instead of silent. This matters for security, because an attacker holding a valid certificate for your domain can impersonate your site convincingly and intercept traffic while the browser padlock still looks normal. CT does not prevent a bad certificate from being issued; its value is making that issuance discoverable so you can respond. WebPixie surfaces CT data for review in the Certificates Manager, while the per-site chain and expiry checks that actually alert you live in SSL monitoring.