What is SSL monitoring?

SSL monitoring is the practice of checking, on a schedule, that the TLS certificate a server actually serves is valid and will stay valid. A monitor opens a real connection to a hostname and port, reads the certificate the server presents, and checks the things that make a browser trust it: the expiry date, the chain of certificates back to a trusted root, and whether the certificate matches the hostname. When one of those is about to fail, it alerts a human before a visitor sees a security warning.

It matters because almost all web traffic now runs over HTTPS — encryption has reached roughly 80% of page loads globally — so a broken certificate means a real outage. And the failure is quiet. A certificate can renew successfully on disk while the web server keeps serving the old one, an intermediate certificate above yours can expire while your own is still fine, or a re-issue can drop a name. In each case an uptime check still returns 200 OK, because the page loads; only a check that reads the certificate from a live handshake sees the problem.

Good SSL monitoring reads the served certificate rather than a stored copy, watches more than the leaf expiry date, and covers every port that terminates TLS — not just 443, but the mail and admin ports where certificates also live and also expire.