Your uptime monitor says the site is up. Your certificate can still be broken.
Verified 24 Jul 2026
UptimeRobot is a good uptime monitor. If you use it, keep it — this page is not going to pretend otherwise.
But SSL monitoring inside an uptime tool usually means one check: the number of days until your leaf certificate expires. That check misses the failure modes that actually take sites down:
• An expired intermediate in your chain. Your certificate is fine, a certificate above it lapsed, and visitors get security errors. This is what broke thousands of sites when the AddTrust root expired — every leaf-expiry check stayed green.
• A served certificate that never reloaded. Renewal succeeded on disk, the web server kept the old certificate in memory, and the renewal logs say success while the countdown continues. Only a live handshake from outside sees it.
• A hostname that stopped matching. A re-issue drops a SAN, or stale DNS points a name at the wrong server. Uptime says 200 OK; browsers say warning.
• The certificate changing when it should not. A certificate you did not issue appearing on your host is worth an alert the same day, not never.
• Mail and admin ports. SMTP on 465/587, IMAPS on 993, a panel on 8443 — each holds its own copy of the certificate, none of them are watched by an HTTP uptime check, and mail clients fail quietly when they expire.
CertPost is the dedicated half of that pairing. Every check opens a real TLS connection and validates what your visitors actually receive: full chain including intermediates, hostname and SAN match, fingerprint change detection, expiry — on any TLS port, over IPv4 and IPv6. Plus the things around the certificate: domain registration expiry, Certificate Transparency issuance alerts, and DNS record drift.
Run both. UptimeRobot answers "is it up?". CertPost answers "is the certificate your users receive actually valid, everywhere it is served?" — and warns you before the answer becomes no.
Three certificates are free forever, checked daily, all alert channels included, no card. Paid is a flat $9/month for up to 100 certificates — not per-certificate pricing.
The five-minute pairing setup:
1. Keep UptimeRobot pointed at your homepage for uptime.
2. Sign up for CertPost free (no card).
3. Paste every hostname that terminates TLS — apex, www, API, mail hosts with their ports (mail.example.com:465, imap.example.com:993), admin panels on 8443. One per line.
4. The dashboard sorts everything by urgency; fix anything red today.
5. Point alerts at the same place UptimeRobot posts — same Slack channel, same webhook — so the on-call picture stays in one stream.
6. Mark hosts with working auto-renew as "auto-renew expected": they stay quiet until 7 days out or a real failure.
One habit worth stealing regardless of tooling: after every renewal, check the served certificate from outside your own machine once. The renewal log and the served certificate are two different facts.
Import your domain list in 2 minutes — 3 certificates free, no card.
Start free