How to monitor SSL certificates across dozens of client sites

Updated 21 October 2026

1. Build the host list

For each client: apex, www, mail (465/587/993/995), API and staging hosts. Search Certificate Transparency logs for the client's domain to find hosts you'd forgotten.

2. Check the served certificate, not the issued one

CT logs show what was issued. Only a TLS connection to the host and port shows what visitors get. Record not-after date, issuer and the names covered.

3. Alert on a schedule

30, 14 and 3 days is a good default. With lifetimes falling to 200 days in 2026 and 47 days by 2029 under CA/Browser Forum Ballot SC-081v3, check daily.

4. Group by client

When an alert fires, you need to know whose site it is and who to call, not just a hostname.

5. Watch for silent changes

A different issuer or a missing name on the new certificate is often the first sign of a misconfigured renewal.

Look up 25 domains free Check a certificate

Sources

Stop tracking renewals in a spreadsheet

RenewRoster tracks every client's domains and certificates, reminds clients under your brand and gives you a monthly renewals report.

The online waitlist opens with the app. To join the beta now, email [email protected] with your agency name and roughly how many domains you manage.

Founding agencies get early access and 50% off their first year. No spam; one confirmation email.