---
title: "SSL & certificate monitoring for Next.js"
canonical: "https://lemwatch.com/monitor/nextjs/ssl"
framework: "Next.js"
concern: "SSL & certificate monitoring"
last_verified: "2026-08-11"
source: "https://lemwatch.com"
---

# SSL & certificate monitoring for Next.js

Expiry warnings 30 days out, chain validation, and cipher grading.

## Why this concern is different on Next.js

Next.js hosted on Vercel auto-renews certs, so most teams stop watching — until a custom domain's DNS drifts and the renewal silently fails. The site keeps serving on the old cert until it expires, then 100% of traffic 522s.

## Signals to watch

- Certificate serial number changing unexpectedly (indicates re-issue)
- SAN list drift when you add a new preview domain
- TLS 1.3 downgrade to 1.2 after Vercel edge routing changes

## What we check (universal)

- Certificate expiry — first warning at 30 days, escalating at 14, 7, 1
- Full chain validation from every check region (catches missing intermediates)
- SSL Labs–style grade (A+ down to F) with the specific weakness called out
- Detects silent CA switch during renewal (e.g. Let's Encrypt → ZeroSSL)

## How Lemwatch helps on Next.js

We alert on cert fingerprint change AND on the 30-day expiry countdown independently, so a stuck auto-renew gets caught weeks before customers notice.

_Canonical HTML page: https://lemwatch.com/monitor/nextjs/ssl_