SSL Certificate Monitoring

SSL certificate monitoring checks your website's TLS certificate for expiry, chain validity, and domain matching. It warns you well before your certificate expires so you have time to renew it -- avoiding the dreaded browser security warning that drives visitors away.

Behind a WAF or Cloudflare?

If the SSL check reports "Couldn't connect to check the certificate" while your site works fine in a browser, your firewall or WAF is likely blocking Hoppla's probe. See Firewall & WAF Allowlisting to fix it.

How It Works

Hoppla connects to your server over TLS, retrieves the full certificate chain, and evaluates it against a set of checks:

• Expiry -- Is the certificate still valid? How many days until it expires?
• Chain validity -- Is the certificate chain complete and trusted?
• Domain match -- Does the certificate's Subject Alternative Name (SAN) list include your monitor's domain?
• Protocol version -- What TLS protocol version did the server negotiate?

Each of these checks produces an individual pass/warning/fail status. The overall check status is determined by the worst individual result.

Certificate Renewal Detection

Hoppla tracks your certificate's issuer and expiry date across check runs. When either changes -- indicating a certificate renewal -- Hoppla sends a certificate.renewed notification so you can confirm the renewal was intentional.

Configuration

Setting	Default	Description
Port	443	The TLS port to connect to. Defaults to 443; common TLS ports are 443, 993, 995, 465, and 8443, but any port from 1 to 65535 is allowed. A handful of sensitive non-TLS ports (such as SSH, SMTP, and database ports) are blocked.
Timeout	10s	Maximum time to wait for the TLS connection, in seconds (1-60).
Warning threshold	30 days	Number of days before expiry at which the check transitions to warning status. Configurable from 1 to 365 days (default 30).
Check interval	3 hours	How often to re-check the certificate.

Results

Each SSL check result includes:

• Status -- ok, warning, or fail
• Certificate issuer -- The Certificate Authority that issued the certificate (e.g., "Let's Encrypt", "DigiCert")
• Valid from / Valid to -- The certificate's validity period
• Days remaining -- Number of days until the certificate expires
• Chain status -- Whether the certificate chain is complete and trusted
• Protocol version -- The negotiated TLS version (e.g., TLSv1.3)
• Domain match -- Whether the certificate covers your monitor's domain
• Individual checks -- Detailed pass/warning/fail status for each aspect of the certificate

Alerts

Incident Creation

An incident with the title "SSL certificate invalid" and severity major is created when any of the certificate checks fail -- for example, if the certificate has expired, the chain is broken, or the domain does not match.

Warning Notifications

A warning.ssl_expiring notification is sent when the certificate's remaining days fall below the configured warning threshold. This gives you advance notice to renew the certificate before it expires.

Certificate Renewal Notification

A certificate.renewed notification is sent when Hoppla detects that the certificate's issuer or expiry date has changed. This is purely informational and helps you confirm that automated renewals (e.g., Let's Encrypt) are working correctly.

Automatic Resolution

If a certificate issue is resolved (e.g., the certificate is renewed or the chain is fixed), the incident is automatically resolved with the message: "SSL certificate is now valid."

Notification Events

Event	When
incident.created	Certificate is invalid, expired, or chain is broken
incident.resolved	Certificate is valid again
warning.ssl_expiring	Certificate expires within the warning threshold
warning.cleared	Certificate was renewed before it expired
certificate.renewed	Certificate issuer or expiry date changed