Skip to content
StatusOwlDocs

SSL & domain expiry

Track certificate validity and days-to-expiry, and WHOIS domain registration expiry with nameserver-change detection. Included on every plan.

Last updated

An expired certificate and a lapsed domain registration are the two outages that are entirely preventable and entirely embarrassing. StatusOwl tracks both.

Both are included on every plan, including Free. SSL certificate checks are capped at 25 per organization on every plan — the cap is flat, not a tier-by-tier ladder. Domain expiry checks are not capped.

SSL certificate checks

StatusOwl performs a TLS handshake against your hostname and inspects the certificate the server presents. Each check records:

  • Not-before and not-after dates.
  • Issuer and subject.
  • Days remaining until expiry.

It evaluates the leaf certificate exactly as a browser would. If the server is misconfigured and omits an intermediate, the handshake fails and the check records an error — the same experience a real visitor would have.

The default check interval is 60 minutes.

Domain expiry checks

StatusOwl queries WHOIS for your domain and tracks the registration expiry date, along with the registrar and the current nameservers. A nameserver change is detected and recorded — useful as an early warning that someone has altered DNS delegation, whether or not they meant to.

The default check interval is once per day. WHOIS servers rate-limit aggressively and registration expiries move on the scale of months, so polling harder buys nothing.

Redacted WHOIS

Many registrars — Cloudflare Registrar, NameSilo, Namecheap with privacy enabled — redact the expiry date from public WHOIS. The check then records an error: it can confirm it ran, but not read the date. For those domains, rely on your registrar's auto-renew setting and treat the StatusOwl check as best-effort.

Thresholds

Each SSL and domain check carries two thresholds:

  • warning_days — default 30.
  • critical_days — default 7.

SSL checks let you override both at creation. Domain checks use the defaults; per-domain customisation is not available.

The days-remaining figure on the detail view is colour-coded against your thresholds, so a certificate inside its warning window is visible at a glance in the dashboard.

What you see

Each SSL or domain check has a detail view showing:

  • Current days until expiry, coloured against the thresholds.
  • Last-checked timestamp and the last error, if there was one.
  • The certificate's issuer, subject and validity window, or the WHOIS registrar, expiry and nameservers.
Crossing a threshold does not notify you

This is the important caveat. Crossing warning_days or critical_days changes what the dashboard shows. It does not send an email, a Slack message or a webhook — nothing dispatches on an expiry threshold today.

The only thing that currently dispatches to a notification channel is a Watch Owl host-metric alert rule. Wiring expiry and uptime through to the notification channels is on the roadmap. Until then, check the dashboard, and keep registrar auto-renew turned on.

The 25-certificate cap

The cap is per organization and applies on every plan. Attempting to create a 26th returns an error naming the limit. If you are managing more certificates than that, the practical approach is to track the ones whose expiry would actually take a service down, and let automated renewal handle the rest.

See also