# SSL and domain

The **SSL and domain** tab of Uptime Monitoring shows when your SSL certificate and your domain registration expire. Renew both before that date. An expired certificate shows a warning to visitors, and a lapsed domain takes the whole site down.

## Before you start [#before-you-start]

- To open the tab, select **Uptime Monitoring** in the domain sidebar, then select **SSL and domain**.
- The tab needs no setup. VitalSentinel checks the certificate and the domain automatically.
- The tab has no filter bar. The cards show today's state.

## SSL certificate [#ssl-certificate]

The SSL certificate is the padlock in the browser. It proves that the site is yours and protects the connection. The **SSL certificate** card of Uptime Monitoring shows:

- How long the certificate is valid, for example **Valid for 81 more days**. It shows **Expired** after the end date, and **Not valid** if the certificate is not valid.
- **Expires**: the date the certificate runs out.
- **Issuer**: the short name of the certificate authority's intermediate certificate that signed yours.
- **Issued for**: the address that the certificate covers.

### Days left on the certificate [#days-left-on-the-certificate]

The color of the **SSL certificate** countdown follows the days left:

| Days left | Result |
|-----------|--------|
| 15 days or more | No issue |
| 14 days or fewer | [Site Health Monitoring](/site-health/overview) raises an issue |

Many sites renew their certificates automatically. If the days left get low, check that the automatic renewal works.

### Issuer names [#issuer-names]

The **Issuer** row shows a short name, not the company name. Examples:

| Issuer | Certificate authority |
|--------|-----------------------|
| R10 to R14, E5 to E9 | Let's Encrypt |
| WE1, WE2 | Google Trust Services |

Authorities change these intermediate names from time to time.

## Domain registration [#domain-registration]

The **Domain registration** card of Uptime Monitoring shows when your domain name expires:

- How long the domain is registered, for example **Registered for 240 more days**. It shows **Expired** after the end date.
- **Expires**: the date the registration runs out.
- **Registrar**: the company that your domain name is registered through. Some registries show a short code, for example `WEBS-0001`. The code identifies the company, not your account.

### Days left on the domain [#days-left-on-the-domain]

| Days left | Result |
|-----------|--------|
| More than 30 days | No issue |
| 30 days or fewer | Site Health Monitoring raises an issue |

### Domains that VitalSentinel cannot check [#domains-that-vitalsentinel-cannot-check]

VitalSentinel reads the expiry date from public registration data (WHOIS). Some domain endings do not publish this data. For these domains, the card shows, for example, **Domain expiry is not checked for .de domains – public registration data is restricted for this ending**. Check the expiry date with your registrar instead.

While the first check runs, the card shows **Checking when the domain expires…**.

## Certificate changes [#certificate-changes]

The **Certificate changes** card of Uptime Monitoring lists every change of your certificate in the last year. If your certificate renews on a regular rhythm, the **?** says how often, for example **Renewed about every 60 days.**

| Column | What it shows |
|--------|---------------|
| **First seen** | When VitalSentinel first saw this certificate on your site, in your account time zone. |
| **Change** | The kind of change. |
| **Issuer** | The intermediate certificate that signed it. |
| **Expires** | When this certificate runs out. |
| **Names** | How many addresses the certificate covers, for example with and without www. |

The **Change** column shows one of these:

| Change | Meaning |
|--------|---------|
| **First seen** | The first certificate that VitalSentinel recorded. |
| **Renewed** | A new certificate for the same names. |
| **Issuer changed** | The authority issued it from another intermediate. |
| **Names changed** | The list of addresses it covers changed. |

**Issuer changed** is normal when an authority changes its intermediates, for example from R12 to R13. It matters only if you did not expect a new certificate.

## Troubleshooting [#troubleshooting]

### Why does the SSL certificate card show No SSL certificate data available? [#why-does-the-ssl-certificate-card-show-no-ssl-certificate-data-available]

If the card shows **No SSL certificate data available**, VitalSentinel has no certificate data for your domain yet.

### Why is my domain expiry not checked? [#why-is-my-domain-expiry-not-checked]

If the **Domain registration** card says **Domain expiry is not checked for** your domain ending, the registry of that ending does not publish registration data. VitalSentinel cannot read the date. Check it with your registrar.

### How do I get an alert before my certificate expires? [#how-do-i-get-an-alert-before-my-certificate-expires]

Set up an alert rule for the certificate on the Alerts page of the domain. See [Alerts](/domain/alerts). Site Health Monitoring also raises an issue when 14 days or fewer are left.

## Related [#related]

- [Uptime Monitoring](/uptime-monitoring/overview) - how the checks work
- [Availability](/uptime-monitoring/availability) - uptime and every outage
- [Site Health Monitoring](/site-health/overview) - issues for an expiring certificate or domain
- [Alerts](/domain/alerts) - get a message before something expires
- [Glossary](/help/glossary#ssl-certificate-expiry) - SSL certificate and domain expiry