Know before your visitors do.
Every check opens a real TLS connection and reads what your server presents today, expiry, chain, protocol and cipher, so a renewal that’s quietly failing shows up on your dashboard, not in a stranger’s browser warning.
Certbot doesn’t call you when it’s failing.
Certbot or your CDN handles renewal automatically, until the day it doesn’t. Nothing on your dashboard changes when a renewal job starts failing, because the old certificate is still valid, for now. The first real signal is usually a customer, or a mobile app that suddenly can’t reach your API.
Cron and hope
Renewal runs on a schedule and nobody checks the result. It has worked for two years, which is exactly how long a silent failure can hide.
Checked over a real connection, daily
Expiry, chain and config are read from an actual TLS handshake, not a cached database row. A certificate that’s renewing late shows up before it becomes urgent.
Renewal is confirmed, not assumed
When a certificate rotates, the new one is checked immediately. You find out the automation is broken from a dashboard, not from a customer.
Which CA you use says more about your infrastructure than you’d think.
A certificate chain and a hostname list reveal real infrastructure detail: which CA you use, how you handle renewal, which subdomains exist at all, the kind a competitor or an attacker doing reconnaissance would find useful. That inventory is processed and stored entirely in the EU.
None of our sub-processors are US companies, so there’s no US legal entity in the chain for a CLOUD Act request to reach.
Why “EU region” isn’t enough
Choosing “EU region” hosting from a US-headquartered company doesn’t remove US jurisdiction over that data. The US CLOUD Act lets US law enforcement compel a US company to produce data it controls, regardless of where the server physically sits, a European datacenter address on the invoice doesn’t change who can be legally compelled to hand it over.
| Sub-processor | Where |
|---|---|
| Scaleway (hosting, database, storage) | France |
| Scaleway Transactional Email | France |
| AhaSend (inbound report email) | Netherlands |
| Mollie (payments) | Netherlands |
| Bunny.net (DNS + CDN) | Slovenia |
The same handshake, checked three different ways
No account, no email gate. Use them one at a time, or run the full check above.
Cert Expiry Checker
Connects over real TLS and reports exactly when a certificate expires, and whether renewal automation is working.
Chain/Issuer Inspector
Walks the full certificate chain a server presents and flags incomplete chains and self-signed certificates.
TLS Config Checker
Reports the negotiated protocol version, cipher, and whether Strict-Transport-Security (HSTS) is present.
A snapshot today. A watch, going forward.
A renewal job can start failing on a Tuesday and stay broken for weeks, because the old certificate is still valid until it suddenly isn’t. This is what runs in the background so that doesn’t happen.
Real TLS handshakes, not cached lookups
Every check opens an actual connection to your server and reads the certificate it presents today, the same way a visitor’s browser does. A database that thinks your certificate is fine because it was fine last week is exactly the failure mode this replaces.
Alerts before your customers notice
An email when a certificate is close to expiry, has expired or its score drops sharply, before your visitors’ browsers warn them. Pro and Business also send to Slack, Teams or a webhook.
3 endpoints free, then Pro or Business
Every account monitors 3 endpoints for free. Pro covers 20 endpoints and 5 users at € 18 a month, Business 150 endpoints and 20 users at € 49, excl. VAT.
Up to two years of history, API access
Pro keeps 12 months of history and Business 24. Both can pull scores and findings into your own dashboard through the API.
Pricing
Billed monthly through Mollie. Prices excl. VAT.
3 endpoints checked daily, email alerts, 30 days of history.
20 endpoints, 5 users, 12 months of history, Slack, Teams and webhooks, API.
150 endpoints, 20 users, 24 months of history, Slack, Teams and webhooks, API.
SSL and DMARC Monitor on one account and one bill.
Straight answers before you connect anything
What’s the difference between the free check and monitoring?
The free check opens one real TLS connection and reports what it finds right now, a snapshot. Monitoring repeats that same connection every day for every endpoint you add, and emails you when a certificate is close to expiry, has expired, or its health score drops sharply. A free account monitors 3 endpoints.
When do I need a paid plan?
When 3 endpoints are not enough, or you want alerts in Slack, Teams or a webhook, API access and a longer history. SSL Monitor Pro covers 20 endpoints and 5 users for €18 a month; SSL Monitor Business covers 150 endpoints and 20 users for €49 a month. Prices excl. VAT.
What data does SSL Monitor store, and where?
The certificate chain, negotiated protocol and cipher, and your list of monitored hostnames: an infrastructure fingerprint, not personal data in the GDPR sense. It’s processed and stored entirely within the EU on self-hosted Supabase running on Scaleway infrastructure in Paris. No sub-processor in the chain is a US-headquartered company.
Does one plan cover multiple subdomains or a wildcard certificate?
Each monitored endpoint is one hostname and port you add to your account, whether it presents a single-domain, multi-domain (SAN) or wildcard certificate. Free includes 3 monitored endpoints, Pro 20 and Business 150.
Can I monitor more than certificates under one account?
Yes. The All-Monitors plan bundles every launched MonitorBase product, currently SSL Monitor, DMARC Monitor and Uptime Monitor, into one subscription, with more products added as they launch at no extra step for existing subscribers.