How often should an agency check its clients' certificates?

Daily at the very least. A deploy can replace or break a certificate at any time, so checking what is actually served several times a day catches problems while there are still days left to fix them.

Do we need monitoring if every site uses Let's Encrypt?

Yes. Automated renewal fails quietly when DNS moves, a challenge path is blocked or a server isn't reloaded, and Let's Encrypt stopped sending expiration emails on 4 June 2025.

When do certificate lifetimes drop to 47 days?

Under CA/Browser Forum ballot SC-081v3, the maximum validity is 200 days for certificates issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029.

Guide · Agencies

SSL monitoring for agencies: a playbook for 20 to 500 client sites

Checked against sources on 2026-09-25 · 4 min read

The problem is ownership, not technology

At 20 client sites, one person remembers everything. At 200, nobody does. The certificates come from a mix of places: the host's automatic Let's Encrypt, a CDN's edge certificate, a paid certificate the client bought years ago, a load balancer a contractor set up. Each renews differently and each fails differently. The fix is mostly a list, a named owner per line, and something that checks what is actually served.

Step 1: build the inventory

Start with the registered domains you look after, then find the hostnames under them. Certificate Transparency logs are the fastest way to do that, because every publicly trusted certificate gets logged. Our guide on finding subdomains with CT logs has the queries, and the free subdomain certificate finder runs them for you. Then record, per hostname:

Field	Why it matters
Hostname	What you are actually monitoring, one row per name
Issuer	Tells you how it probably renews (an ACME CA, a commercial CA, a CDN)
Renewal method	ACME on the server, managed by the host or CDN, or manual
Where TLS terminates	Web server, load balancer or CDN. This is where a fix gets deployed
Renewal owner	A named person at the agency, or the client, in writing
Client contact	Who hears about it when something goes wrong

The bulk SSL checker fills in issuer and expiry for a pasted list, which covers the first three columns in one go.

Step 2: decide who owns each renewal

Every certificate falls into one of three buckets, and the handover document or contract should say which:

Agency-managed. You control the server and the ACME client. You renew, you get paged.
Host-managed. The host or CDN renews automatically. You still monitor, because automation fails quietly.
Client-managed. The client buys and installs the certificate. You remind them early and in writing, and you monitor anyway.

Monitoring applies to all three buckets. The bucket only decides who fixes it.

Step 3: automate what you can

ACME (RFC 8555) is the default for good reason: manual certificates are the ones that expire. Let's Encrypt's integration guide recommends checking ACME Renewal Information (RFC 9773) at least twice a day, and as a backstop renewing when a third of the certificate's lifetime is left. For each remaining manual certificate, ask whether the original reason for buying it still holds. Sometimes it does. Often the answer is that nobody remembers.

Don't count on the CA to remind you either. Let's Encrypt stopped sending expiration emails on 4 June 2025, citing, among other reasons, how many subscribers now have reliable automation. That is fair for them and a gap for you: the email that used to catch a broken renewal no longer arrives. Our guide on the end of those emails covers the options.

Step 4: plan for shorter lifetimes

The CA/Browser Forum passed Ballot SC-081v3 in April 2025. The resulting schedule is in the Baseline Requirements:

Before 15 March 2026 the maximum was 398 days.
Issued on or after	Maximum validity	Domain validation reuse
15 Mar 2026	200 days	200 days
15 Mar 2027	100 days	100 days
15 Mar 2029	47 days	10 days

At 47 days, a certificate renewed by hand needs attention about eight times a year. Across 200 certificates that is more than 1,500 renewals a year, which is a job title, not a task. Let's Encrypt is moving too: its announcement says the default classic profile switches to 64-day certificates on 10 February 2027 and to 45-day certificates on 16 February 2028. The 47-day readiness checker shows which of your hosts will struggle, and our 47-day certificates guide has the detail.

Step 5: route alerts so they get read

Alerts get ignored when they arrive too loud, too early or in the wrong place. A 30-day notice in the on-call channel teaches everyone to mute the on-call channel. A starting point:

Days left	Severity	Where it goes
30	Info	Email digest or the ticket queue
14	Warning	Team channel (Slack or Teams)
7	Warning	Team channel plus the named owner directly
3 and 1	Critical	Owner and whoever is on call
0 (expired)	Incident	Everyone who can fix it, plus the account manager

One refinement pays for itself. An ACME certificate should renew when a third of its life is left, so if a 90-day certificate is down to 25 days, the renewal has already failed. Treat that as a failure today rather than a warning in a fortnight.

Watch the domains while you're at it

A valid certificate on an expired domain is still a dead site. The same inventory should carry each registered domain's expiry date, registrar and nameservers, read over RDAP, with alerts set well ahead of the registrar's own reminders. The domain expiry monitoring guide covers grace periods and what to watch. It is the same discipline with a longer fuse.

Step 6: report to clients

Clients pay for what they can see, and good certificate work is invisible by design. A one-page monthly report makes it visible: hosts covered, certificates renewed, next expiries, domain expiry dates, and anything that went wrong with what you did about it. Put your agency's name on it, not your tooling vendor's.

Comparing approaches

Generic categories, not specific products. Test any tool against your own inventory.
Approach	Catches expiry	Catches a failed auto-renewal early	Finds hosts you don't know about	At 500 sites
Calendar reminders	If someone entered the date	No	No	Unworkable
Shared spreadsheet	If someone keeps it current	No	No	A part-time job
Uptime monitor with an SSL add-on	For the URLs you added	Depends on the thresholds you can set	No	Works, if every host is added
Dedicated certificate monitoring	Yes	Yes, if it knows when renewal should have happened	If it reads CT logs	Built for it

ExpiryOwl sits in the last row: certificates checked every six hours, CT-log discovery, alerts at 30, 14, 7, 3, 1 and 0 days by email, Slack, Teams, Discord, Telegram or webhook, and white-label client reports. The free plan covers 5 domains with no card. Our page for web design agencies shows how it fits a typical retainer.