How does Lemwatch track SSL certificate expiry?
Lemwatch reads the TLS certificate on every uptime check and starts alerting 30, 14, 7, and 1 day before expiry so you never ship an expired cert.
Quick answer#
During every HTTPS uptime probe we read the leaf certificate, extract the notAfter date, and schedule reminders at T-30, T-14, T-7, and T-1 day. Auto-renewed certs simply refresh the countdown.
What we surface#
Where to find it in Lemwatch#
Site → Security → SSL.
FAQ#
Do you support wildcard certs?#
Yes — SAN entries are tracked individually.
What about self-signed certs?#
We surface them but do not send expiry alerts.
Related#
Previous
How does Lemwatch detect DNS record changes?
Next
How does Lemwatch detect WordPress plugins and themes?
Related Articles
How does Lemwatch detect DNS record changes?
Lemwatch resolves your A, AAAA, MX, NS, CNAME, and TXT records on every check and hashes them — any hash change triggers a DNS change incident.
Security Headers Explained
What security headers are, why they matter, and how to fix them.
DNS MX record check
Monitors MX records so a fat-fingered mail edit or expired provider does not silently break customer email.
DNS NS record check
Alerts when authoritative nameservers change — the fastest warning of a domain hijack or unauthorised registrar transfer.