What is SSL certificate monitoring?

Choose the right check for the question

Certificate work gets confusing when every tool is treated as the same kind of monitoring. Start with the question you need answered.

What a one-time checker is good for

A free SSL checker answers what a domain or subdomain serves right now. Use it after renewal, before CDN changes, during incidents, or when a customer reports a browser warning.

• Read issuer, SANs, serial number, fingerprint, validity dates, chain depth, and validation state.
• Separate DNS, TCP, TLS handshake, hostname, active-window, expiry, and trust-chain problems.
• Share a short-lived result with a teammate while diagnosing the hostname.

When scheduled monitoring is worth it

Scheduled monitoring is worth adding when the hostname needs recurring ownership. It repeats checks, stores history, applies expiry thresholds, and sends warnings to the channels your team watches.

• Use it for app, API, checkout, identity, docs, CDN, and client domains.
• Use it when renewals depend on more than one person or vendor.
• Use it when certificate changes should be reviewable after platform work.

What Domain Trust Watch does

Domain Trust Watch checks monitored public TLS endpoints, records certificate snapshots, tracks expiry windows, detects served-certificate changes, and sends events through email, Slack incoming webhooks, and signed customer webhooks.

What Domain Trust Watch does not do

Domain Trust Watch does not issue certificates, renew certificates automatically, request private keys, install an internal agent, or provide live Certificate Transparency alerts.

• Private/internal certificate monitoring is outside the public-hostname model.
• Certificate Transparency monitoring is a separate security requirement.
• Broad uptime, APM, logs, tracing, on-call, status pages, and incident management remain separate tools.