Monitoring SSL/TLS Certificate Expiration

An expired SSL/TLS certificate is one of the most common—and avoidable—causes of website downtime. While general uptime checks tell you if the site is "up," an SSL Monitor ensures your security layer is valid.

Why Monitor SSL?

• Browser Blockers: Modern browsers prevent users from accessing sites with expired or invalid certificates.
• Brand Trust: Security warnings ("Your connection is not private") drive away 70% of potential traffic.
• Search Ranking: Google penalizes sites with security configuration issues.

How to Create an SSL Monitor in supaguard

While supaguard focuses on Playwright browser journeys, you can easily create a dedicated "Security Check" using our standard execution engine.

Method 1: Playwright-Native Assertion

You can check if the page loaded securely and inspect the certificate details via the request or response object.

import { test, expect } from '@playwright/test';

test('verify ssl certificate is valid', async ({ page }) => {
  const response = await page.goto('https://your-site.com');
  const securityDetails = await response.securityDetails();

  // 1. Assert that the protocol is secure
  expect(securityDetails.protocol()).toContain('TLS');

  // 2. Alert if certificate expires in less than 30 days
  const validUntil = securityDetails.validTo();
  const daysRemaining = (validUntil * 1000 - Date.now()) / (1000 * 60 * 60 * 24);
  
  expect(daysRemaining).toBeGreaterThan(30);
});

Method 2: API-Based SSL Check

If you only want to check the certificate without loading the full browser UI, use a lightweight API check.

test('api ssl check', async ({ request }) => {
  const response = await request.get('https://api.your-app.com');
  const security = await response.securityDetails();
  
  expect(security.subjectName()).toBe('your-app.com');
  expect(Date.now() / 1000).toBeLessThan(security.validTo());
});

Recommended Monitoring Strategy

Alerting Best Practices

For SSL checks, we recommend a specific Alert Policy:

1. Channel: Send to your #security-alerts or #ops Slack channel.
2. Threshold: One single failure is enough to investigate.
3. Remediation: If an alert fires, check your certificate provider (e.g., Let's Encrypt, DigiCert) for auto-renewal failures.

[!IMPORTANT] Unlike Datadog, which charges a premium for dedicated "SSL Tests," supaguard allows you to run these as standard checks within your existing credit pool.

Next Steps

• API Monitoring Guide
• Multi-Region Network
• Firewall Allowlisting