The problem
An SSL certificate tells a browser that your site is who it says it is. It has an end date. When that date passes, the browser shows a warning page instead of your site, and many visitors will not click through it. The site may still be running well. The people using it simply cannot reach it.
This happens more often than it should because the renewal is easy to forget. If the certificate renewed automatically the last time, you may not think about it for a year. If the renewal failed, nothing else in your setup tells you. The web server keeps serving, the database is fine, and the page still loads for anyone who ignores the warning. The first person to notice is often a customer.
For a solo developer or a freelancer running a client's site, the message lands with you. For a small agency, the risk multiplies. Each site has its own date, its own renewal route and its own person who needs to act. One missed date on one client site is enough to damage a relationship that took years to build.
The fix is not complicated. It is a reminder that arrives early enough to do something about it, sent to someone who can do it.
How it works
An expiry alert has three parts.
First, something checks the certificate. A scheduled check reads the end date from the site's certificate and compares it with today's date. You do not need to open a browser and look at a padlock to know where things stand.
Second, a threshold. Most people set a warning some weeks before expiry, then a sharper warning closer to the date. A single alert on the day itself is too late if the renewal has already failed, or if the email arrived in a folder nobody opens on a Friday afternoon. Two warnings give you time to fix a problem and then check that the fix worked.
Third, a clear recipient. The alert has to reach a named person who can renew the certificate or ask someone to. An inbox that nobody reads is not an alert. Alert emails go only to people in your organisation, so add the person who handles renewals and keep the list short enough that everyone on it knows what the message means.
Renewal often runs as a scheduled job rather than by hand. Many servers use a tool that runs on a timer, asks the certificate authority for a new certificate and installs it. That job can fail quietly. It might not start after a server restart, or a changed path might stop it finding the files it needs. Nothing on the site looks wrong until the old certificate expires.
A heartbeat monitor covers this case. The job sends a ping to AperioFlow each time it finishes. While the pings keep arriving on schedule, the monitor stays quiet. If a ping stops arriving, the monitor raises an alert. You do not have to log into the server and read the job's output to find out that it stopped.
The two checks do different work. An expiry check tells you that a certificate is getting close to its end date, whatever the cause. A heartbeat tells you that the job meant to renew it ran. Used together, they catch the common failures: the renewal never ran, or it ran and did not produce a new certificate. Either way, you hear about it while there is still time to fix it.
The cost of getting this wrong is high and the setup is small. Once a monitor is in place, it does the watching for you, and you only need to act when it speaks.
Getting started
Start with the sites that matter most: the ones your customers use every day, and the ones where a warning page would cost you money or trust. Write them down. For each one, decide who should hear the first warning and who should hear the second.
Then set up your monitors. The free plan includes 10 monitors, which is enough to cover a handful of client sites or your own products while you learn how the alerts behave. If a renewal script runs on a server, add a heartbeat monitor for that job and have the script send its ping when it finishes successfully. Test it once by running the job by hand and checking that the ping arrives. Then wait for the next scheduled run and check again. A test that passes once is a good start, but the scheduled run is the real test.
Choose your warning window and write it down. Some people want the first warning a month before expiry, so there is time for a slow change through a client's approval process. Others are happy with two weeks. Pick a number, use it consistently, and review it each time you add a site.
Keep a short note for each certificate: where it was issued, which server or host it lives on, and who has access to renew it. The alert is only useful if the person it reaches can act on it quickly. A note that says where the renewal login is kept will save you an hour on a bad day.
If you are a team, the Team plan is 29 pounds a month flat for up to 10 people, as shown on the pricing page. Everyone who handles renewals can receive the alerts, and the monthly price does not change with the number of sites you add within your plan limits. Check the pricing page for the current details before you decide.
Tweed Tyne runs its own work on AperioFlow, so the monitors and alerts described here are the ones we use day to day. If you ever want to leave, you can download your data.
If you want to try this on your own sites, you can Start free at https://app.aperioflow.co.uk/#/signup and have your first monitor running the same day.
And if a feature or check is not shown on the pricing page or in the docs, do not rely on it until you have confirmed it there. That applies to any specific certificate check you plan to use.