An actionable certificate check combines the public expiry information with a named renewal owner and a recovery plan. Monitor the certificate customers actually receive, and separately track any origin certificate hidden behind a proxy.
01 Make expiry visible and owned
- Add or review an HTTPS monitor for each important hostname. Use the intended name rather than an IP address that presents a different certificate.
- Review SSL expiration tracking in the website dashboard and compare it with the certificate shown by a current browser or TLS diagnostic tool.
- Confirm the available certificate alert behaviour for your 360 Monitoring plan and interface. Assign the responsible contacts and test their delivery methods.
- Record the certificate order, renewal mechanism, validation owner and earliest action date. Allow time for DNS or organisational validation and deployment.
- Check independently managed CDN, origin, mail and control-panel certificates. A public website monitor may see only the CDN's edge certificate.
- After renewal, verify that the live endpoint shows the replacement expiry and serial number. Close the task only after deployment is confirmed.
Common questions
Does automatic billing mean the certificate renewed successfully?
Payment, validation, issuance and installation are separate stages. Monitor the installed certificate and resolve a pending validation request before expiry.
What if my dashboard has expiry tracking but no threshold setting?
Check the account's available alert controls with support and use a separate owned reminder where needed. Do not assume a specific notification threshold exists because the dashboard displays an expiry.
How far ahead should we act?
Choose a lead time that covers your real validation and change process. Shorter certificate lifetimes make tested automation and prompt failure handling more useful than an annual reminder.