SSL and Domain Expiry Monitoring: A Plain-Language Guide

Two dates decide whether a client site stays reachable: the day the SSL certificate expires and the day the domain registration lapses. Both are printed somewhere in a registrar or hosting dashboard. Both are easy to forget until a browser stops a visitor with a warning page.

For an agency watching dozens of client sites, those two dates are a quiet liability. You cannot see them from your invoice, and clients rarely know they exist. This guide explains what actually happens when each one passes, how expiry monitoring catches it early, and how to turn an upcoming date into a short note your client will understand.

What an expired SSL certificate does to a visitor#

An SSL certificate is the document that lets a browser open your client's site over HTTPS. It has a start date and an end date, and when the end date passes, the certificate is no longer trusted.

The visitor does not get a graceful error. Modern browsers show a full-page interstitial: a red or gray warning that says the connection is not private, with an advanced option most people never click. The site is technically still online. Practically, it looks broken, and a portion of visitors will leave before they read anything on it.

Two numbers matter here:

• 0 seconds of warning. The moment the certificate expires, every new visit shows the interstitial.
• An unknown share of abandoned visitors. Some will proceed anyway, but you cannot count on the traffic that turns back.

On its own, this is a bad day. Worse is when it happens to a site the client uses to take payments or bookings, because the trust damage outlasts the outage.

What a lapsed domain registration does#

A domain registration is a lease, not a purchase. You renew it for a set term, usually one to five years. If it lapses, the site does not simply disappear in the way most people expect. It moves through a sequence:

1. Grace period. For roughly 0 to 45 days after the expiry date, the domain usually keeps resolving and can be renewed at the normal price.
2. Redemption period. For the next ~30 days, the domain is pulled from normal service. You can still recover it, but the registrar typically charges a redemption fee well above the standard renewal price.
3. Pending delete. Around 5 days, after which the domain drops and anyone can register it.

That last stage is the real risk. A dropped domain can be picked up by a stranger, and email sent to it can start landing in the wrong hands. For a client whose business email sits on that domain, the downside is larger than a website outage.

How expiry monitoring works#

Expiry monitoring watches the two dates for you, without anyone logging into a dashboard to check.

PulseKeeper reads the certificate it gets back when it connects to a site, and it reads the domain's registration record. It does this from three separate regions, so a single blocked location does not create a false reading. When a date falls inside the window you set, it raises an alert.

You can set that window per site. A portfolio site might need two weeks of notice. A site with a shared payment flow or a long renewal chain might need sixty days. The alert lands before the date, which is the whole point: the goal is a routine renewal, not an emergency.

The lead time to set for each client site#

Renewals fail for boring reasons. An old card on file. A registrar email that goes to a former employee. A certificate that renews automatically but only if the DNS record has not changed.

Set lead time by how much can go wrong, not by how much you trust the process:

• Simple brochure site, automatic renewal working: 14 days. Enough to confirm it renewed.
• Client-managed domain or certificate: 30 days. You need time to reach the person who holds the login.
• E-commerce, booking, or anything tied to revenue: 45 to 60 days. Assume one failed attempt before it works.
• Domains tied to business email: 60 days. Email breakage is quiet and takes longer to notice.

When an alert fires, you want a checklist, not a scramble. Confirm the renewal went through, confirm the new certificate is serving, and confirm the domain's registration now shows the next expiry date.

Turning an expiry into a short client heads-up#

Most clients do not need the certificate explained. They need to know a date is coming, that you are handling it, and what you need from them.

Keep it to a few lines:

• What is happening. "The security certificate on your site expires on [date]."
• What it means if missed. "If it lapses, visitors see a warning page instead of your site."
• What you are doing. "We are renewing it and will confirm once it is live."
• What you need. "Nothing for now" or "we need the card on file updated by [date]."

Lead with the reassurance. State the concrete date. Never send it without a date. A message that says "your certificate may expire soon" creates worry and no action.

Where this fits in your monitoring#

Uptime checks answer "is the site up?" Expiry monitoring answers a different question: "will it still be reachable in a month?" One catches a break that already happened. The other prevents a break you can still avoid.

For a single site, a calendar reminder can cover it. For a portfolio of client sites, calendar reminders fail quietly, because there are always more dates than anyone tracks by hand. Set the watch on the date, let the alert do the remembering, and keep the renewal a line item instead of an incident.

Your clients will judge the relationship by what they see. An expired certificate is the one failure they can see without opening a tool.