RadardueSSL certificate expiry monitoring for MSPs
An expired certificate is one of the most avoidable outages there is, and one of the most embarrassing to explain to a client. When you look after dozens of clients, the hard part isn't renewing certificates. It's knowing every certificate exists, and hearing about the right one at the right time.
Why it's getting harder
Public certificate lifetimes are shrinking in steps: a 200-day maximum since March 2026, 100 days from March 2027, and 47 days from March 2029. Let's Encrypt's default drops to 64 days in February 2027 and 45 days in February 2028. Every certificate you renew by hand today will need renewing several times a year, and automated renewals that run on a fixed schedule will start to miss. The details are in our guides to Let's Encrypt's shorter certificates and 47-day certificates.
What to monitor
Checking a date in a spreadsheet isn't monitoring. For each host, a useful check looks at what the server actually presents:
- The certificate actually served. A certificate renewed on disk but never loaded by the web server, load balancer or appliance still expires. Only a live TLS connection tells you what clients see.
- The chain and the hostname. A missing intermediate or a certificate issued for the wrong name breaks some clients long before the expiry date.
- Ports other than 443. Mail (465, 993, 995), VPN portals, RDP gateways and admin interfaces on 8443 have certificates too, and they're the ones nobody remembers.
- Who issued it and how it renews. A Let's Encrypt certificate that renews every 60 days on a cron job is fine today and broken in 2027. A one-year commercial certificate means a manual renewal someone has to own.
Find the hosts nobody wrote down
The certificate that expires is rarely on the documented list. It's the old staging site, the marketing landing page a designer set up, or the VPN appliance installed three years ago. Public Certificate Transparency logs record every publicly trusted certificate, so searching them for a client's domain lists every hostname that has had a certificate. Go through that list with the client once, decide what still matters, and monitor all of it.
Alert timing that people act on
A single reminder 30 days out gets snoozed and forgotten. A good schedule gets louder as the date approaches:
- A heads-up at 30 and 14 days for anything renewed by hand or by a vendor.
- Daily reminders in the final week until someone acknowledges they're on it.
- A final nudge a few days before, even after someone acknowledged, in case the fix didn't land.
Send alerts where the team already works (a shared Slack or Discord channel, a Telegram group, or your PSA or ticketing system through a webhook) rather than to one engineer's inbox. If a client has its own IT contact, send that client's alerts to them too.
Give every certificate an owner
Most expiry incidents aren't technical. Everyone assumed someone else was renewing it. For each certificate, note who renews it, how (ACME client, vendor portal, manual CSR), and where the credentials live. Put that note next to the date, not in a separate wiki page.
Report it to clients
Certificates and domains are a natural QBR topic. A one-page renewal report per client shows what's coming up, what you renewed, and which hosts need changes before 2027. It turns invisible work into something the client sees you doing.
A simple checklist
- For each client, pull every hostname from Certificate Transparency logs and confirm which are still in use.
- Add non-443 services by hand: mail, VPN, RDP gateways, admin panels.
- Check the served certificate, chain and hostname daily.
- Alert a shared channel on a 30/14/7-day schedule with daily reminders in the final week.
- Record an owner and renewal method for every certificate.
- Fix fixed-interval ACME renewals before February 2027.
- Share a renewal report with each client every quarter.
How Radardue fits
Radardue does this for you: type a client's domain and it lists every hostname from Certificate Transparency logs, checks what each host serves daily on any TLS port, flags renewal habits that will break with shorter certificates, and alerts your team by email, Slack, Discord, Telegram or webhook, per client if you like. Client reports are one click. Check a site for free, or explore the demo.