Next.js SSL & certificate monitoring
Expiry warnings 30 days out, chain validation, and cipher grading.
The Next.js-specific angle
Next.js hosted on Vercel auto-renews certs, so most teams stop watching — until a custom domain's DNS drifts and the renewal silently fails. The site keeps serving on the old cert until it expires, then 100% of traffic 522s.
What we watch on Next.js
- Certificate serial number changing unexpectedly (indicates re-issue)
- SAN list drift when you add a new preview domain
- TLS 1.3 downgrade to 1.2 after Vercel edge routing changes
Universal ssl & certificate monitoring checks
Same on every stack — these run on your Next.js site out of the box:
- Certificate expiry — first warning at 30 days, escalating at 14, 7, 1
- Full chain validation from every check region (catches missing intermediates)
- SSL Labs–style grade (A+ down to F) with the specific weakness called out
- Detects silent CA switch during renewal (e.g. Let's Encrypt → ZeroSSL)
Reference thresholds we alert against
How Lemwatch handles it on Next.js
We alert on cert fingerprint change AND on the 30-day expiry countdown independently, so a stuck auto-renew gets caught weeks before customers notice.
More Next.js monitoring guides
Next.js SSL & certificate monitoring — FAQs
We alert on cert fingerprint change AND on the 30-day expiry countdown independently, so a stuck auto-renew gets caught weeks before customers notice.
Next.js hosted on Vercel auto-renews certs, so most teams stop watching — until a custom domain's DNS drifts and the renewal silently fails. The site keeps serving on the old cert until it expires, then 100% of traffic 522s.
No. Lemwatch is fully black-box — we monitor what visitors and Googlebot see. Add your domain, checks start within 60 seconds, and no plugin, SDK, or code change is required in your Next.js app.
Pro plans run 1-minute checks from multiple regions. When a regression trips a rule (e.g. p75 LCP up >20% for 3 consecutive windows, or cert expiry <7 days), the notification fires within the next check cycle — typically 60 seconds.
Yes. Add HTTP basic auth headers or a bearer token per site, and Lemwatch treats staging as an isolated site — flaky preview envs won't pollute your production status board.