SSL & certificate monitoring monitoring for Next.js
Next.js hosted on Vercel auto-renews certs, so most teams stop watching — until a custom domain's DNS drifts and the renewal silently fails. The site keeps serving on the old cert until it expires, then 100% of traffic 522s.
What's different about Next.js
Next.js hosted on Vercel auto-renews certs, so most teams stop watching — until a custom domain's DNS drifts and the renewal silently fails. The site keeps serving on the old cert until it expires, then 100% of traffic 522s.
Signals to watch on Next.js
Certificate serial number changing unexpectedly (indicates re-issue)
SAN list drift when you add a new preview domain
TLS 1.3 downgrade to 1.2 after Vercel edge routing changes
How Lemwatch surfaces it
We alert on cert fingerprint change AND on the 30-day expiry countdown independently, so a stuck auto-renew gets caught weeks before customers notice.
What we check for ssl & certificate monitoring
Certificate expiry — first warning at 30 days, escalating at 14, 7, 1
Full chain validation from every check region (catches missing intermediates)
SSL Labs–style grade (A+ down to F) with the specific weakness called out
Detects silent CA switch during renewal (e.g. Let's Encrypt → ZeroSSL)
Other ways Next.js sites break
Uptime, Core Web Vitals, and build-output monitoring for Next.js sites.
Common failure modes
ISR revalidation stuck on stale content
Edge runtime cold-start spikes after deploy
404s from missing dynamic route params
Image Optimization API throttling under traffic bursts