SSL Monitoring
Never let a certificate expire by surprise. Monitor SSL certificate expiry, chain validity, and replacements with progressive warnings.
How SSL Monitoring Works
Unsparing connects to your HTTPS endpoints, retrieves the certificate chain, and tracks:
- Expiry date — alerts at 30, 14, and 7 days before expiry
- Certificate chain — validates the full chain from leaf to root
- Fingerprint changes — detects when a certificate is replaced
Adding an SSL Monitor
- Navigate to SSL → Monitors and click Add Monitor
- Configure the monitor:
| Field | Description |
|---|---|
| Hostname | The domain to monitor (e.g., example.com) |
| Port | HTTPS port (default: 443) |
| Warning Thresholds | Days before expiry to trigger warnings |
Alert Schedule
Unsparing uses progressive warnings so you're never caught off guard:
| Days Before Expiry | Alert Level |
|---|---|
| 30 days | Info — time to plan renewal |
| 14 days | Warning — renewal should be in progress |
| 7 days | Critical — renew immediately |
| Expired | Emergency — site may be unreachable |
What Gets Checked
Expiry Date
The most common SSL issue. Unsparing checks the notAfter date and alerts you progressively.
Certificate Chain
A valid certificate isn't enough — the full chain must be correct. Unsparing validates:
- The leaf certificate matches the hostname
- Intermediate certificates are present and valid
- The root certificate is trusted
- No expired certificates in the chain
Fingerprint Changes
When a certificate is replaced (renewal or reissuance), the fingerprint changes. Unsparing logs this so you can:
- Confirm automated renewals worked
- Detect unauthorized certificate replacements
- Track certificate rotation history
Common Issues Detected
| Issue | Description |
|---|---|
| Self-signed certificate | Not trusted by browsers |
| Expired intermediate | Chain breaks even if leaf is valid |
| Hostname mismatch | Certificate doesn't cover the domain |
| Weak signature | SHA-1 or other deprecated algorithms |
| Missing intermediate | Incomplete chain causes browser errors |
API Endpoints
List SSL Monitors
curl -H "Authorization: Bearer YOUR_API_KEY" \
https://api.unsparing.dev/api/v1/ssl/monitorsCreate an SSL Monitor
curl -X POST -H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"hostname": "example.com", "port": 443}' \
https://api.unsparing.dev/api/v1/ssl/monitorsPlan Limits
| Plan | SSL Monitors |
|---|---|
| Free | 2 |
| Homelabber | Unlimited |
| Teams | Unlimited |
| Agency | Unlimited |