Monitoring Let's Encrypt certificates

Let's Encrypt issues free certificates through automated renewal, and it has become the default for much of the web: it is used by roughly two-thirds of the sites whose certificate authority is known, and issues on the order of ten million certificates a day. Its certificates last 90 days and are meant to renew automatically, which is exactly why monitoring them feels optional and is not.

Automation moves the risk rather than removing it. A renewal can fail because a rate limit was hit, a DNS or HTTP validation broke, a cron job stopped running, or the new certificate was issued but the web server was never reloaded to serve it. None of those show up in the renewal logs as a problem, and with a 90-day window a stalled renewal has weeks to go unnoticed before the certificate actually expires.

Monitoring Let's Encrypt certificates is about catching the renewal that did not happen. A check that reads the served certificate sees the real expiry date and the real certificate on the wire, so it notices when the countdown stops moving — the renewal succeeded on disk but the old certificate is still being served — long before a visitor does. As certificate lifetimes shrink across the industry, the same discipline applies to every automated certificate, not just Let's Encrypt's.