An expired certificate takes your site down
Browsers block the page, APIs and integrations stop working, and your team learns about it from support tickets.
How we help: Daily checks and escalating alerts well before the expiry date.
SSL/TLS, domain and website security monitoring
Stop finding out about expired certificates from your customers.
Monitor SSL checks every endpoint of your sites every day, warns you before certificates and domains expire, tells you when a certificate you did not expect is issued for your domains, and keeps your certificates and keys in one secure place.
- Nothing to install
- Alerts by email and signed webhooks
- Built for teams, with roles and an audit log
Your sites
Checked today
-
Validwww.example.comExpires in 74 days · 3 of 3 endpoints OK
-
Renew soonshop.example.comExpires in 12 days · critical alert sent
-
Mismatchapi.example.com1 of 4 endpoints still serves the old certificate
-
New issuanceexample.comUnexpected certificate found in CT logs
The problem
Certificates and domains fail quietly — until they fail loudly
Most incidents are not sophisticated attacks. They are a date nobody was watching, a server nobody remembered or a file nobody could find.
One server behind the load balancer was missed
You renewed the certificate, but one node or CDN edge still serves the old one. Some visitors see an error, others don't.
How we help: We connect to every address your hostname resolves to and flag mismatches.
Someone issues a certificate for your domain
A certificate obtained by another team, a vendor or an attacker is invisible unless you look at the public logs.
How we help: Certificate Transparency monitoring alerts you to new and unexpected certificates.
The domain itself expires
When the registration lapses, your site and your email go with it — and getting the domain back is not guaranteed.
How we help: Registration expiry tracking plus alerts on DNS, DNSSEC and CAA changes.
Attackers send email as your company
A DMARC policy of p=none or an SPF record that allows everyone looks configured but stops nothing.
How we help: An email security review of SPF, DMARC, DKIM, MTA-STS and TLS-RPT that checks what the records actually enforce.
Private keys live in inboxes and chat threads
PFX files and passwords get passed around by email, and nobody knows which copy is current or who has it.
How we help: An encrypted certificate vault with role-based exports and one-time share links.
How it works
Up and running in minutes
No agents, no firewall changes. Monitor SSL checks your sites from the outside, the way your visitors reach them.
-
Add your sites and domains
Enter a hostname or a domain. You can also upload the certificates you already have and invite your team.
-
We watch every day
Every endpoint is checked daily, along with domain registration, DNS, email security, reputation and Certificate Transparency logs.
-
You hear about it before it breaks
The right people get an email or a signed webhook when something changes or approaches expiry — once per level, not every day.
Features
Everything you need to keep HTTPS, domains and keys under control
Grouped by the outcome you care about.
- Never miss an expiry
- See every certificate issued for your domains
- Harden your sites
- Manage certificates safely
- Built for teams
Never miss an expiry
Know what is about to expire, everywhere it is deployed.
Daily multi-endpoint checks
A TLS handshake with each address your hostname resolves to, so a single stale server behind a load balancer or CDN is caught.
Escalating alerts without the noise
Email alerts when a certificate or domain reaches warning, critical or expired — sent once per level, not every day it stays there.
Daily digest and status report
Alerts are bundled into one morning email per recipient, plus an optional daily status report for the people you choose.
Domain expiry and DNS changes
Registration expiry from RDAP/WHOIS, with alerts when DNS, DNSSEC or CAA records change.
Live certificate checker
Inspect the certificate and full chain any host serves before you add it to monitoring.
See every certificate issued for your domains
What your servers present is only part of the story. Public logs show the rest.
Certificate Transparency monitoring
Public CT logs are read every day and you are alerted when a new certificate appears for your domains.
Discover forgotten hostnames
Hostnames found in issued certificates that you are not monitoring yet, ready to add in one click.
Know who issues for you
See which certificate authorities issue for each domain and get a suggested CAA record based on the issuers actually in use.
Harden your sites
On-demand assessments that explain what to fix and why.
TLS and security header assessments
TLS configuration (including a Qualys SSL Labs grade), security headers, cookies and checks based on the OWASP Top 10.
Outdated and end-of-life software
Technology fingerprinting, end-of-life versions, vulnerable client-side libraries and WordPress plugins.
Malware and reputation
Daily host reputation checks against URLhaus, plus a scan of the page content for signs of compromise.
Email security posture
SPF, DMARC, DKIM, MTA-STS and TLS-RPT evaluated for what they actually enforce, not just whether they exist.
PDF reports and history
Consolidated PDF reports you can download or email, with each run compared against the previous one.
Authorized penetration probes
Active probes run only after an organization admin explicitly authorizes them for that host.
SEO and best practices
Metadata, performance and general best-practice checks, in the same report.
Manage certificates safely
One place for certificates and keys, instead of shared folders and chat threads.
Certificate vault
Upload PFX, PEM or ZIP bundles. Details are extracted automatically and each certificate is monitored for expiry.
Chain check and repair
Missing intermediate certificates are detected and fetched automatically, so every export carries the full chain.
Export in the format you need
PFX (modern or legacy-compatible PKCS#12), PEM, CER, P7B and full chain. Exports that include the private key are limited to admins.
Secure one-time sharing
Share a certificate with a link that requires a code sent by email, expires on its own and can be revoked at any time.
CSR generation
Create a certificate signing request in the portal; the private key is stored encrypted.
Let's Encrypt with automatic renewal
Issue certificates through DNS-01 validation and let Monitor SSL renew them before they expire.
AI-assisted change procedures
Keep a written certificate-change procedure for each site; the AI assistant helps turn rough notes into clear steps.
Built for teams
Shared visibility, clear permissions and a record of every change.
Organizations and roles
Belong to several organizations and give each member the Admin or Viewer role.
Invitations
Invite colleagues by email with time-limited invitations.
Alert routing
Choose who is notified for each site, certificate and domain.
Audit log
See who changed what and when, across the organization.
Delivery logs
Check exactly which emails and webhooks were sent, and whether they were delivered.
Security and trust
We hold your keys, so we protect them like keys
Monitor SSL is a security product. These are the controls that protect your data inside it.
Encryption at rest for secrets
Private keys, PFX passwords, authenticator secrets, webhook secrets and one-time codes are encrypted field by field in the database.
Strong, passwordless sign-in
Sign in with an email code, an authenticator app or a passkey, with recovery codes, lockout after repeated failures and sign-out from every device.
Organization isolation
Every query is scoped to your organization at the data layer, so one customer's data is never visible to another.
Least privilege
Viewers can see status and reports; only admins can export private keys, manage members or change settings.
Links that cannot be replayed
Share and invitation links are stored only as hashes, expire on their own and require a second factor where keys are involved.
A complete audit trail
Changes to your data are recorded with who made them, and secret values are redacted from the log.
Integrations
Works with the tools you already use
Alerts reach your team where they work, and checks build on trusted public sources.
Alerts, daily digests, status reports and PDF assessment reports.
Webhooks
Events signed with HMAC-SHA256 and a timestamp, retried automatically with backoff, and logged per delivery.
Let's Encrypt
ACME issuance with DNS-01 validation and automatic renewal.
Certificate Transparency
Public CT logs, queried daily for every monitored domain.
Qualys SSL Labs
An independent TLS grade inside your assessment reports.
URLhaus and RDAP
Malware host reputation and domain registration data from public sources.
Pricing
Simple plans based on how many sites you monitor
Every plan includes every feature. Pick the number of sites you need and change plans as you grow.
Free
For a few sites and getting started
Free
Up to 5 sites
- Daily multi-endpoint checks
- Email alerts and daily digest
- Domain intelligence and CT monitoring
- Security assessments and PDF reports
- Certificate vault and secure sharing
Basic
For teams with a growing portfolio
$1,500.00
per year
Up to 20 sites
- Every feature included
- Signed webhooks
- Let's Encrypt with automatic renewal
- Team roles, invitations and audit log
Professional
For teams with a growing portfolio
$2,500.00
per year
Up to 50 sites
- Every feature included
- Signed webhooks
- Let's Encrypt with automatic renewal
- Team roles, invitations and audit log
Enterprise
For large certificate portfolios
$6,000.00
per year
Up to 500 sites
- Every feature included
- Sized for large portfolios
- Pricing tailored to your volume
FAQ
Frequently asked questions
Do I need to install anything?
No. Monitor SSL checks your sites from the outside over the internet, exactly as a visitor would. You only add hostnames and domains in the portal. For Let's Encrypt issuance you add a DNS TXT record that the portal gives you.
How often are my sites checked?
Every monitored site, domain and Certificate Transparency watch is checked once a day. You can also run a check or a security assessment on demand at any time.
Can I monitor internal or private servers?
No. For safety, Monitor SSL only connects to publicly routable addresses; private and internal network addresses are rejected. It is designed for internet-facing sites and services.
Will security assessments affect my site?
Standard assessments send a small number of ordinary requests. Active penetration probes send more traffic, so they only run after an organization admin confirms the host and explicitly authorizes them.
How are my certificates and private keys protected?
Private keys, PFX passwords and other secrets are encrypted at rest, exports that include a private key are limited to admins, and sharing uses expiring one-time links that also require a code sent by email.
How do alerts work?
You are notified when a certificate or domain enters a new level — warning, critical or expired — instead of every day it stays there. Alerts go by email (bundled in a daily digest) and, if you configure them, to your webhooks.
Does Monitor SSL make me compliant with PCI DSS or HIPAA?
No tool can do that on its own. Some assessments include technical checks inspired by PCI DSS and HIPAA safeguards, which help you find gaps, but they are not a certification or an audit.
Can my whole team use it?
Yes. Invite colleagues by email, give them the Admin or Viewer role, choose who receives each alert and review every change in the audit log.
Know about the problem before your customers do
Create your account, add your first site in a couple of minutes and let Monitor SSL keep watch every day.