Catch certificate problems before your visitors do
Spectate checks the full certificate chain your server sends, warns 14 days before anything in it expires, and tells you when a certificate is untrusted, self-signed or issued for another name.
- The whole chain
- Leaf, intermediates and root, as your server sends them.
- Expiry warnings
- 14 days ahead by default, anything from 1 to 90 days.
- Renewal heads-up
- A notice when a renewal comes from a different issuer.
Every certificate in the chain, not just the first
The checkers connect the way a browser does and verify the whole chain your server sends, so a missing or expiring intermediate shows up even when your own certificate is fine.
- Leaf, intermediates and root with fingerprints
- Served chain compared with the trust store
- Expiring intermediates alert by name
- Kestrel
- Monitors
- Website
- Certificate
- Endpoint
- kestrel.eu:443
- Protocol
- TLS 1.3
- Chain is trustedUp to a root in the public trust store
- Valid for kestrel.euThe name matches the certificate
- R11 expires before the leaf12 Nov 2026 · 19d left
Certificate chain
As the checker saw it, leaf first.
- servedLeafkestrel.euissued by R11 (Let's Encrypt)24 Aug 2026 → 22 Nov 202629d left
- servedIntermediateR11issued by ISRG Root X113 Mar 2024 → 12 Nov 202619d left
- trust storeRootISRG Root X1self-signed · trust store4 Jun 2015 → 4 Jun 20358y left
Expired, untrusted or issued for the wrong name
Every 15 minutes, from the region that runs the monitor. When a problem gets worse, the alert is replaced so you only see the current one.
- Expired and not yet valid
- Hostname mismatch
- Untrusted chain and self-signed certificates
Warned in time, told when it changes
Each monitor has its own expiry threshold. When a renewed certificate comes from a different authority, you get a separate heads-up, so a switch of provider never goes unnoticed.
- Threshold per monitor, 14 days by default
- Issuer change on renewal as a separate notice
Everything in SSL certificates
HTTPS, TCP and mail
Checked on HTTPS monitors and on TCP and mail monitors with TLS.
STARTTLS support
Mail servers are checked after STARTTLS as well as on TLS ports.
Fingerprint tracking
Spectate notices when the certificate changes.
Plain-words explanations
Alert mails explain the error and what to check first.
Modern TLS only
Servers stuck on TLS 1.0 or 1.1 are flagged.
No extra cost
Part of the monitor's price.
Included on every plan. See pricing
SSL certificates: questions
How far ahead does Spectate warn before an SSL certificate expires?
14 days by default. You can set the threshold per monitor to anything from 1 to 90 days. The warning applies to every certificate in the chain, so an intermediate certificate that expires before your own certificate is reported by name.
Does Spectate check intermediate certificates?
Yes. The checker records the whole chain your server sends, leaf, intermediates and root, and verifies it against the trust store. A missing, expired or untrusted intermediate is reported even when the leaf certificate is still valid, which is a common cause of errors on older devices and API clients.
Which certificate errors does Spectate detect?
Expired certificates, certificates that are not valid yet, hostname mismatches, chains that don't lead to a trusted root, and self-signed certificates. Each is explained in plain words in the alert, with the certificate chain and suggestions for what to check.
How often are certificates checked?
Every 15 minutes, from the checker region that runs the monitor. Certificate checks run alongside the regular uptime check, so they need an HTTPS monitor, or a TCP or mail monitor with TLS. They are included in the price of that monitor.
Can I monitor SSL certificates on mail servers?
Yes. SMTP, IMAP and POP3 monitors with STARTTLS or implicit TLS check the server's certificate as well as its greeting. TCP monitors with TLS turned on do the same for any other service, such as a database or a custom port.
Is SSL monitoring free?
There is no separate charge: certificate checks are included with every HTTPS, TLS or mail monitor on all plans. Spectate has no free plan; monitors cost €0.50 to €0.75 a month, and new teams get a 14-day trial of the Team plan without payment details.
Know about it first.
Set up your first monitor in under a minute. 14 days free, no credit card.