Q: How do I set up SSL expiry alerts so I never get caught off guard?

Q: How do I set up SSL expiry alerts so I never get caught off guard?

A: One expired cert can take down everything at once. Here's the full layer cake.

— Add a dedicated certificate-expiry monitor (separate from your uptime check) for every hostname, including www and any subdomains.
— Set three alert thresholds: 30 days, 14 days, and 3 days out. The 30-day one is for planning, the 3-day one is the panic button.
— Monitor the actual edge that serves traffic (CDN/load balancer), not just origin. They often have different certs.
— Check intermediate chain validity too, not only the leaf cert.
— Even with auto-renewal (Let's Encrypt), keep the monitor. Renewals fail silently all the time.

Follow-up: don't forget non-web certs like SMTP and your API endpoints. They expire too.

Got a question? Drop it in the comments.