An expired certificate is one of the quickest ways to lose visitors. The site still loads on your own machine, but browsers show a full-page warning to everyone else, and many people simply leave. If you run a client site, a product or a small internal tool, you are usually the person who finds out, often after a customer has already emailed you.
This guide explains the problem in plain terms, how an HTTPS monitor checks your certificate, and how to set one up on AperioFlow.
The problem
An SSL or TLS certificate is what lets a browser trust that a site is the real one and that the connection is encrypted. It has a start date and an end date. When the end date passes, browsers stop trusting the site until someone renews the certificate and installs the new one.
The trouble is that nothing in the day-to-day running of a site tells you when that date is coming. Renewal is often automated, but not always. A renewal can fail quietly because a DNS record changed, a validation step was blocked, or the server was moved and the new one was never set up. Someone may have bought the certificate by hand years ago and left no reminder.
So the failure usually looks the same each time. A visitor sees a warning, a client rings you, and you spend the next hour working out which certificate has expired and where it is installed. A few days' notice would have turned that into a ten-minute renewal.
That is the job a certificate check is meant to do. It looks at the certificate your site is actually serving, reads the expiry date, and tells you while there is still time to act.
How it works
On AperioFlow, certificate checks are part of every HTTPS monitor. You do not set up a separate type of monitor for them. When you add an HTTPS monitor for a site, the check connects to the address you gave, reads the certificate that the server presents, and records how many days are left before it expires.
The monitor then warns you at three points: when 30 days are left, when 14 days are left, and when 7 days are left. Three warnings give you a chance to plan the renewal, then to do it, then to confirm it has gone through. If the certificate is renewed earlier, the warnings stop being relevant and the monitor shows the new expiry date.
The warnings are sent by email, web push and webhooks. Webhooks are useful if you want the warning to land in a chat channel or a ticketing tool your team already watches. Alert emails go only to people in your organisation, so a client's address will not receive a notice about your internal settings unless you have added them to the organisation.
There are a few things worth knowing about how this kind of check behaves:
- It reads what the server presents to the outside world. If your certificate is installed on a load balancer or a CDN, the check sees that one, which is usually what visitors see too.
- It works on the address you enter. If your site is reached at both a www address and a bare domain, add both, because they can carry different certificates.
- It tells you the expiry date, not whether the renewal process is working. A certificate that renews on the first of the month will show a fresh date after renewal, so the warnings simply stop. If one does not renew, the warnings will keep arriving and tell you so.
The check runs from the UK, so it sees your site the way a UK visitor does.
Getting started
Setting up a certificate warning takes a few minutes if you already know the address of the site.
First, sign in to AperioFlow, or create an account if you do not have one. The free plan includes 10 monitors, which is enough to cover several small sites while you see how the checks behave.
Next, add a new monitor and choose the HTTPS type. Enter the full address of the site, including https://. Give the monitor a name your team will recognise, such as the client's name and the domain. Save it.
Then check who will receive the alerts. Alert emails go only to people in your organisation, so make sure the right people are added. If you want warnings to reach a shared channel, add a webhook as well. Email is the default route for most people, and web push is useful if you want a browser notification while you are working.
Finally, check that the first reading looks right. The monitor should show the certificate's expiry date. If the date is wrong, the most common cause is that the address points to a different server from the one you expected, such as a staging site or an old host. Correct the address and the reading will update.
Once a monitor is running, you do not need to look at it each day. The warnings at 30, 14 and 7 days are the point. If you have several client sites, add each one as its own HTTPS monitor so that each certificate is tracked separately.
If you want to see how the checks look on your own sites, you can start free at https://app.aperioflow.co.uk/#/signup. Add one HTTPS monitor, look at its expiry reading, and you will know quickly whether it fits the way you already work.
An expired certificate is rarely a hard problem to fix. It is a problem that arrives without notice. Knowing the date in advance changes a stressful afternoon into a routine renewal.