It was a Tuesday morning. One of our team members opened a browser tab, navigated to a client site, and saw the red padlock. “Your connection is not private.”

The SSL certificate had expired at midnight. The certificate had been issued 12 months earlier, renewed once already, and then — somehow — the renewal reminder got lost. The hosting provider sent it to an email address that nobody actively monitored. It sat there, unread, while the expiry date counted down to zero.

The site had been showing security warnings to every visitor for nearly seven hours before anyone noticed.

This is an incident post-mortem. Not a dramatic one — no data was lost, no breach occurred. But it's a useful one, because SSL expiry is one of the most preventable, most embarrassing, and most common causes of avoidable downtime.

What Happened

The setup: A client site on a shared hosting environment with an annual SSL certificate managed by the hosting provider. Auto-renewal was supposedly enabled but had silently failed when the payment method on file expired.

The failure chain:

1. Credit card expired → auto-renewal failed
2. Renewal failure email sent to an unmaintained inbox
3. No other alerting in place
4. Certificate expired at 00:00
5. Site began serving security warnings to all visitors
6. First report came from a client employee at 07:15 who tried to log in
7. Total exposure window: approximately 7 hours

The impact: Unknown number of visitors turned away by browser security warnings. Several form submissions that may not have completed. Client trust damage. An uncomfortable conversation.

What Was Missing

The root cause wasn't the expired payment method — that was the trigger. The root cause was the absence of any independent monitoring of the SSL certificate itself.

If we'd had SSL certificate monitoring in place, we would have received an alert 30 days before expiry, then 14 days, then 7 days. We would have caught the renewal failure before the certificate expired, not seven hours after.

The lesson isn't “don't let payment methods expire” — that's too shallow. The lesson is: never rely on a third-party provider's alerting as your only safety net. Hosting providers send renewal reminders to the email address you registered with, which might be five years old and unmaintained. They do not call you when their auto-renewal silently fails.

What We Changed

After this incident, we set up SSL monitoring for every client site in Acumen Logs. The configuration took about 20 minutes for the entire client portfolio.

For each domain, we now monitor:

• Certificate validity — is it currently valid?
• Days until expiry — alert at 30 days, 14 days, and 7 days
• Certificate issuer — so we're notified if a certificate changes unexpectedly
• Domain expiry — separately from the SSL, because domain registrations lapse too

Alerts go to our team's Slack channel and to a shared email inbox that is actively monitored.

Six Months Later

In the six months since setting this up, we caught two certificate expiry warnings — both at the 30-day mark. Both were renewed before anyone noticed. One was for a client that had similarly switched payment providers without updating their hosting account.

The monitoring paid for itself in the first catch.

What This Looks Like in Practice

Setting up SSL monitoring in Acumen Logs is straightforward:

1. Navigate to SSL Monitoring
2. Add the domain you want to monitor
3. Set your alert thresholds (we recommend 30, 14, and 7 days)
4. Assign your alert channel (email, Slack, or both)
5. Save

You'll get an immediate confirmation of the current certificate status — issuer, expiry date, and whether it's currently valid. From that point on, you'll never be surprised by an expired certificate again.

The Broader Point

SSL expiry is a microcosm of a broader monitoring philosophy: don't trust that things are working just because nobody has told you they're broken. Infrastructure fails quietly. Third-party renewals fail silently. The seven-hour window before anyone noticed wasn't unusual — for sites without monitoring, it's often measured in days.

Independent monitoring is the only reliable source of truth about whether your services are actually working.