Why manual tracking fails
A spreadsheet with expiry dates works right up until someone leaves the company, a calendar reminder gets snoozed once too often, or a new hostname goes live without anyone adding it to the list. Certificate expiry monitoring that depends on a human remembering is monitoring that will eventually fail — not because anyone was careless, but because it's the kind of task that's invisible until the exact moment it isn't.
What proper monitoring actually checks
Expiry date is the obvious one, but it's not the only thing that silently breaks a site. A complete check covers:
- Days until expiry, with enough lead time to catch a failed renewal attempt
- Whether the full certificate chain is served, not just the leaf certificate
- Whether the certificate actually covers the hostname being checked
- Domain registration expiry — a lapsed domain takes down everything at once
- Whether the renewal process looks automated, or is quietly still manual
Automated monitoring, not automated renewal
A scanner and a renewal tool solve different problems. An ACME client like Certbot renews certificates; a scanner tells you whether that renewal actually worked, whether the chain is complete, and whether anything else about the TLS setup needs attention — regardless of which tool issued the certificate in the first place. Both matter: automation that silently stops working is exactly what expiry monitoring exists to catch.
Check any hostname free
SUN-DRAM Scanner runs a full TLS and DNS check — certificate, chain, protocol support, security headers, email authentication, and a specific read on whether this hostname is ready for the CA/Browser Forum's 100-day certificate lifetime cut in March 2027. No signup, no cost, and the result is a link you can share with anyone.