--- title: "SSL certificate monitoring for the whole chain" description: "SSL certificate monitoring that checks leaf, intermediates and root from Spectate's checkers. Expiry alerts 14 days ahead, hostname and trust errors, issuer changes." url: https://spectate.net/features/ssl-monitoring last_updated: 2026-10-26 --- # Catch certificate problems before your visitors do > Spectate checks the full certificate chain your server sends, warns 14 days before anything in it expires, and tells you when a certificate is untrusted, self-signed or issued for another name. - **The whole chain.** Leaf, intermediates and root, as your server sends them. - **Expiry warnings.** 14 days ahead by default, anything from 1 to 90 days. - **Renewal heads-up.** A notice when a renewal comes from a different issuer. ## Every certificate in the chain, not just the first The checkers connect the way a browser does and verify the whole chain your server sends, so a missing or expiring intermediate shows up even when your own certificate is fine. - Leaf, intermediates and root with fingerprints - Served chain compared with the trust store - Expiring intermediates alert by name ## Expired, untrusted or issued for the wrong name Every 15 minutes, from the region that runs the monitor. When a problem gets worse, the alert is replaced so you only see the current one. - Expired and not yet valid - Hostname mismatch - Untrusted chain and self-signed certificates ## Warned in time, told when it changes Each monitor has its own expiry threshold. When a renewed certificate comes from a different authority, you get a separate heads-up, so a switch of provider never goes unnoticed. - Threshold per monitor, 14 days by default - Issuer change on renewal as a separate notice ## Everything in SSL certificates - **HTTPS, TCP and mail.** Checked on HTTPS monitors and on TCP and mail monitors with TLS. - **STARTTLS support.** Mail servers are checked after STARTTLS as well as on TLS ports. - **Fingerprint tracking.** Spectate notices when the certificate changes. - **Plain-words explanations.** Alert mails explain the error and what to check first. - **Modern TLS only.** Servers stuck on TLS 1.0 or 1.1 are flagged. - **No extra cost.** Part of the monitor's price. ## Frequently asked questions ### How far ahead does Spectate warn before an SSL certificate expires? 14 days by default. You can set the threshold per monitor to anything from 1 to 90 days. The warning applies to every certificate in the chain, so an intermediate certificate that expires before your own certificate is reported by name. ### Does Spectate check intermediate certificates? Yes. The checker records the whole chain your server sends, leaf, intermediates and root, and verifies it against the trust store. A missing, expired or untrusted intermediate is reported even when the leaf certificate is still valid, which is a common cause of errors on older devices and API clients. ### Which certificate errors does Spectate detect? Expired certificates, certificates that are not valid yet, hostname mismatches, chains that don't lead to a trusted root, and self-signed certificates. Each is explained in plain words in the alert, with the certificate chain and suggestions for what to check. ### How often are certificates checked? Every 15 minutes, from the checker region that runs the monitor. Certificate checks run alongside the regular uptime check, so they need an HTTPS monitor, or a TCP or mail monitor with TLS. They are included in the price of that monitor. ### Can I monitor SSL certificates on mail servers? Yes. SMTP, IMAP and POP3 monitors with STARTTLS or implicit TLS check the server's certificate as well as its greeting. TCP monitors with TLS turned on do the same for any other service, such as a database or a custom port. ### Is SSL monitoring free? There is no separate charge: certificate checks are included with every HTTPS, TLS or mail monitor on all plans. Spectate has no free plan; monitors cost €0.50 to €0.75 a month, and new teams get a 14-day trial of the Team plan without payment details. ## Pricing Included on every plan, from €15 a month (€0.50–€0.75 per monitor). 14-day trial, no credit card. See https://spectate.net/pricing. ## Related - [Uptime monitoring](https://spectate.net/features/uptime-monitoring): Uptime monitoring with HTTP(S), keyword, ping, TCP, DNS and mail checks every 30s from Europe, North America, Asia or Oceania. From €0.50 per monitor. - [Domains](https://spectate.net/features/domain-monitoring): Domain expiry monitoring with registry lookups (RDAP or WHOIS) every 6 hours: alerts 30 days before a domain expires and when its registrar, nameservers or DNSSEC keys change. - [Alerting](https://spectate.net/features/alerting): Alerts by email, Slack, Teams, Discord, Telegram, Pushover, webhook, SMS and phone call, with escalation paths that branch on severity, working hours, source and labels.