How We Built an Automated SSL & Domain Expiry Monitoring Engine (And Cut $3,600/yr in SaaS Fees)

The 6:00 AM Outage Alarm That Every Web Operator Dreads

It happens to almost every engineering agency at some point: A client domain renewed automatically, but the Let's Encrypt renewal hook failed silently because of an Nginx configuration conflict. At 6:00 AM, customers begin seeing the terrifying red warning screen:

When you manage 150+ production domains across CodXpert, Anterpreneur, and international client portals, manual spreadsheets fail. But commercial SaaS uptime tools want $25/mo per 10 domains, quickly scaling to $300+/month ($3,600/year).

We decided to solve this permanently by building our own dedicated monitoring portal at ssl.codxpert.com.

How the TLS Inspection Engine Works Under the Hood

Rather than running heavy, resource-intensive headless Chrome instances, the core engine uses lightweight PHP stream sockets to capture the remote peer certificate in under 50ms:

// 1. Establish lightweight TLS Stream Context
$context = stream_context_create([
    "ssl" => [
        "capture_peer_cert" => true,
        "verify_peer" => false,
        "verify_peer_name" => false,
    ]
]);

// 2. Query port 443 with 15s timeout
$socket = @stream_socket_client("ssl://{$host}:443", $errno, $errstr, 15, STREAM_CLIENT_CONNECT, $context);
$params = stream_context_get_params($socket);
fclose($socket);

// 3. Parse X.509 Certificate Metadata
$certInfo = openssl_x509_parse($params['options']['ssl']['peer_certificate']);
$expiryTimestamp = $certInfo['validTo_time_t'];
$daysRemaining = (int) floor(($expiryTimestamp - time()) / 86400);

Asynchronous Cron Sweeps & Multi-Tier Escalation Alerts

A monitoring system is only as reliable as its alert delivery. We engineered automated Artisan commands (CheckSslCertificates and CheckDomainExpiries) executed by daily cron jobs:

• 30 Days Out: Low-priority digest email sent to the assigned account manager.
• 14 Days Out: Automated ticket generated and sent to the client primary technical contact.
• 7 Days Out: High-priority alert triggered to engineering on-call leads.
• 24 Hours Out: Critical emergency escalation dispatched via SMS/Telegram.

The Long-Term ROI of Building Internal Security Infrastructure

Over 2+ years of production operation, the system at ssl.codxpert.com delivered:

• Zero Outages: 100% uninterrupted SSL validity across 150+ web properties including Niagara Print Express and Taskly.
• Zero Recurring SaaS Overhead: Saved $3,600+ annually compared to third-party monitoring suites.
• Client Retention Asset: We package free automated SSL and domain monitoring as an exclusive retention perk for all CodXpert enterprise maintenance clients.

Step-by-Step Guide: Deploying a Lightweight SSL Daemon on Linux

If you want to set up an automated SSL monitoring worker on your own VPS or dedicated server, here is the exact production deployment architecture we recommend:

sudo apt-get update && sudo apt-get install -y php8.2-cli php8.2-curl php8.2-openssl

* * * * * cd /var/www/ssl.codxpert.com && php artisan schedule:run >> /dev/null 2>&1

Top 4 SSL Failure Modes (And How Automated Monitoring Prevents Them)

Understanding why SSL certificates fail in real-world environments is the key to foolproof uptime engineering:

• Certbot Cron Job Silent Failures: Renewal cron jobs can fail when webroot directories change or port 80 HTTP-01 challenges are blocked by modified firewall rules. Automated stream-socket monitoring detects when the active expiration date has not extended.
• Mismatched Intermediate CA Bundles: Installing a renewed leaf certificate without the full CA certificate chain causes mobile devices and APIs to reject connections.
• Domain DNS Registrar Lapses: When an underlying domain expires or DNS nameservers revert, automated SSL checks immediately return connection timeouts, alerting the infrastructure team hours before customer tickets arrive.
• Wildcard Subdomain Omissions: Adding new production microservices or staging environments without matching SAN coverage is caught instantly during system onboarding.