Make time to renew
Advance warnings give you time to investigate a renewal before the certificate expires.
SSL & Certificate Monitoring
Certificates never expire at a convenient time.
Watch the certificate your endpoint actually serves. See expiry, hostname coverage and the supplied certificate chain, then act on warnings before a renewal becomes an emergency.
SSL / SAMPLE OUTPUTIllustrative example
example.com · CN/SAN · expiry · supplied chain
Fictional values. Not a live measurement.
01 / What it does
Inspect what your server actually serves
Hoppla retrieves and parses the certificate from your TLS endpoint. It checks expiry and activation dates, matches the hostname against CN/SAN fields, and inspects the supplied chain for possible incompleteness and SHA-1 signatures. Mixed-content monitoring is a separate check.
What’s included
- ✓Configurable expiry warning threshold (30 days by default)
- ✓CN/SAN hostname coverage checks
- ✓Expired and not-yet-active certificate detection
- ✓Self-signed and SHA-1 warnings
- ✓Supplied certificate-chain inspection
- ✓Issuer and expiry changes recorded as renewal events
02 / How it works
Under the hood.
01
Connect to the endpoint
The SSL check connects to the configured port and retrieves the certificate and chain supplied by the server.
02
Inspect certificate health
Expiry, activation dates, hostname coverage, self-signing and SHA-1 signatures produce explicit check results. Chain completeness is a heuristic based on the supplied certificates, not full trust-path validation.
03
Warn before expiry
Set the expiry warning threshold for the check. The default is 30 days; configured alert rules determine notification delivery.
04
Track renewal changes
Changes to the issuer or expiry date produce a certificate-renewed event, with previous and current certificate details.
03 / Why it matters01Expiry 02CN/SAN 03Renewal
The part that actually moves the needle.
Check the right hostname
A certificate with time left can still cover the wrong domain. Hostname checks make that failure visible.
See what changed
Compare the issuer and validity dates when a new certificate is detected.
04 / For every team
Whoever you are, this lands differently.
Solo SaaS founder
Keep certificate dates and hostname coverage alongside your website monitoring.
Small agency
Review certificate health across client sites and act on expiry warnings.
Large agency
Use certificate details and renewal events to investigate changes across your monitored sites.
Reseller / hosting provider
Include certificate monitoring in your customer monitoring workflow and use the supported branding configuration.
Switching tools
Monitoring somewhere else? Bring your setup with you.
Import the monitors you already run in another tool. What comes across depends on the provider. Run both side by side for 24 hours or 7 days before you switch.
- ✓ Guided import
- ✓ Shadow run before you switch
- ✓ Coverage varies by provider
Import from
- Oh Dear
- Uptime Robot
- Better Stack
- Pingdom
- StatusCakeBeta
- CronitorBeta
- Healthchecks.ioBeta
- Statuspage
The importer opens in your workspace once you have access.
Get early accessFOR HOSTERS & RESELLERS
See the reseller program When a customer's certificate lapses on your infrastructure, the broken padlock wears your brand. Expiry warnings arrive under your name, with time left to renew.
05 / FAQ
Straight answers.
Does Hoppla check OCSP revocation or validate the full trust path?
The current SSL check does not query OCSP or validate the certificate chain against a trusted root. It inspects the certificate and supplied chain, including hostname coverage, dates and signature warnings.
How early does Hoppla warn about expiry?
The check warns once the certificate is inside your threshold (30 days by default, configurable 1–365). After that, Hoppla notifies again only as expiry gets closer, at 7, 3 and 1 day left. Delivery follows your alert configuration.
Do I need monitoring if certificates renew automatically?
Monitoring the served certificate can reveal expiry or hostname problems when automatic renewal or deployment fails.
Is mixed content part of the SSL check?
No. Mixed-content monitoring is a separate check for insecure resources on HTTPS pages.
Your next step
Stop guessing when your certificates expire.
Checks, alerts and status pages in one workspace. Now in early access: join the list for an invite.