What is checked
HTTPS requests use certificate validation. A certificate that the worker cannot validate causes the request to fail. HTTP URLs do not provide certificate metadata.
When an HTTPS connection returns certificate metadata, UpBastion reads the certificate's expiry date. The monitor detail page can display the saved expiry date. This date is recorded from the certificate presented to the monitoring server, which can be the certificate at a CDN or reverse proxy.
Daily metadata updates
The worker attempts to update saved certificate metadata when it has no previous certificate check or the previous update is more than one day old. This happens during ordinary monitoring checks; there is no independent scheduled TLS scanner.
Metadata can remain older when the worker is unavailable, the monitor is paused, or the request cannot return a certificate. An absent or old expiry date does not prove that a certificate has renewed successfully.
The expiry warning
When a retrieved expiry date is in the future and within 14 days, the worker queues an email to the account's verified primary email address. It records that expiry date so the same monitor does not repeatedly receive the same warning on later daily updates.
A renewed certificate with a different expiry date becomes eligible for its own future warning. UpBastion does not send a configurable series of reminders. A certificate that has already expired can cause an ordinary failed HTTPS check and a confirmed downtime incident.
Redirects and the monitored host
Certificate metadata belongs to the original HTTPS host in the monitor URL. When that host redirects, the saved expiry date does not change to the final destination's certificate. An HTTP URL redirecting to HTTPS has no original HTTPS certificate to save.
To observe the certificate at the final destination, create a separate HTTPS monitor for that destination. The URL guide explains why a canonical URL often gives the clearest result.
Renew and verify
Use your hosting or certificate-management tools to renew the certificate, then check that the public endpoint actually presents the renewed certificate. Restart or reload the relevant server only if your certificate setup requires it. UpBastion observes certificates; it does not renew or install them.
For Let's Encrypt users, Let's Encrypt's notice about expiry emails explains that its email reminder service ended in 2025. Keep your own renewal and verification process.
Read email alerts if a warning did not arrive, or troubleshooting for failed certificate validation.