Check what is served, not what is configured
The certificate in your configuration and the certificate on the wire are different things, and the gap between them is where outages live. A renewal can succeed on disk while the running process keeps serving the old one from memory because nothing reloaded it.
That is why an external check matters. It observes what a real client sees, from outside your infrastructure, with no assumptions about your deployment pipeline.
What to look at beyond the expiry date
- Chain completenessA valid leaf with a missing intermediate works in browsers that cache it and fails in stricter clients like curl and mobile SDKs.
- Hostname coverageConfirm the SAN list actually includes the host being served. Wildcards do not cover multi-level subdomains.
- Issuer changesAn unexpected issuer can indicate a misrouted request or an interception proxy.
- Validity windowCertificate lifetimes keep shortening. Renewal automation that worked at 90 days needs revisiting as windows narrow.
One-off checks catch today, not tomorrow
A manual lookup confirms the certificate is fine right now. It does nothing about the renewal that will silently fail in eleven weeks. Continuous checking is the only version of this that actually prevents an outage.