SSL / TLS Certificate Monitoring
Track certificate health, catch expirations before they happen, and identify weak cipher configurations.
An expired certificate takes your site offline for every user and triggers browser security warnings that are hard to recover from. Weak cipher configurations expose connections to known cryptographic attacks. RiskShelter monitors both continuously.
What gets tracked
Expiration: the number of days until the certificate expires. Alerts fire at 30, 14, and 7 days to give you time to renew before anything breaks.
Certificate Authority: identifies who issued the certificate (Let's Encrypt, DigiCert, Sectigo, Cloudflare) and validates the full trust chain.
Subject Alternative Names (SANs): the full list of domains covered by the certificate. This often surfaces related domains and subdomains you might not have been tracking.
TLS protocol version: flags servers still accepting TLS 1.0 or TLS 1.1, both deprecated and vulnerable to known exploits. TLS 1.2 and TLS 1.3 are expected.
Cipher suites: detects weak algorithms (RC4, 3DES, CBC-mode ciphers) associated with attacks like BEAST, POODLE, and SWEET32.
Self-signed certificates
Self-signed certificates on production subdomains are flagged separately. They're common on staging environments that accidentally face the public internet (browsers treat them as untrusted, and they provide no protection against man-in-the-middle attacks).