How We Built an Automated SSL & Domain Expiry Monitoring Engine for 150+ Properties
1. The Problem: The Hidden Risk of Expired SSL Certificates & Forgotten Domains
At CodXpert and Anterpreneur, we manage and operate over 150+ production web applications, e-commerce storefronts (including Niagara Print Express), internal agency portals (Taskly), and client infrastructures.
Managing this scale presented three critical operational bottlenecks:
- Catastrophic Brand Risk: If a single client SSL certificate expires unnoticed, web browsers display a red security warning (
NET::ERR_CERT_DATE_INVALID), halting all checkout transactions, destroying SEO rankings, and eroding customer trust. - Domain Expiration Blindspots: Client domains registered across fragmented registrars (GoDaddy, Namecheap, Google Domains) lacked centralized tracking, leading to forgotten renewal notices buried in personal inboxes.
- Aggressive SaaS Per-Seat & Per-Domain Pricing: Commercial uptime monitoring tools charged $15 to $35/month for small 10-domain tiers, totaling over $300/month ($3,600+/year) just to receive basic expiration pings.
2. The Solution: Engineering a Proprietary TLS Inspection Engine
Instead of paying recurring software licenses for fragmented tools, we engineered a dedicated, high-speed monitoring platform at ssl.codxpert.com built on modern PHP, Laravel, and asynchronous cron daemons.
Stream-Socket TLS Inspection
Uses raw PHP stream context capture (stream_socket_client) and openssl_x509_parse to inspect remote X.509 certificate chains, issuer authority, and exact Unix timestamp expiration dates without heavy browser emulation overhead.
Multi-Tier Escalation Alerts
Automated cron workers (CheckSslCertificates & CheckDomainExpiries) sweep all registered domains daily, firing multi-channel escalation notifications at 30 days, 14 days, 7 days, and 24 hours prior to expiration.
3. System Architecture & Database Structure
The engine separates public verification checks from scheduled cron background workers:
| Component | Technology | Responsibility |
|---|---|---|
| TLS Core Parser | OpenSSL PHP Extension | Connects to port 443 with 15s timeout to extract peer certificate metadata. |
| Scheduler Daemon | Laravel Console Kernel | Executes batch inspections and evaluates threshold triggers every 24 hours. |
| Notification Engine | SMTP & Webhook Dispatcher | Sends templated alert emails to domain owners and engineering on-call leads. |
| RBAC Portal | Tailwind CSS + MySQL | Multi-tenant client dashboard for domain additions and SSL status logs. |
4. Business Impact & ROI
By deploying our own in-house SSL and domain monitoring portal at ssl.codxpert.com, CodXpert achieved:
- 100% Certificate Uptime: Zero unplanned HTTPS security outages across all client web properties over 2+ years of production operation.
- Complete Cost Elimination: Saved over $3,600/year in third-party SaaS subscription fees.
- Instant Client Value Add: Provided our agency clients with a branded self-service monitoring portal as a value-added service.
5. Engineering Deep-Dive: Handling SNI, Wildcards & TLS Edge Cases
Building a production-ready certificate monitor is far more nuanced than simply pinging port 443. Over 150+ diverse client setups, our engineering team had to design algorithmic mitigations for several complex network edge cases:
Server Name Indication (SNI)
Modern hosting clusters host dozens of client domains on a single shared IP address. Without setting SNI_enabled and explicitly passing peer_name in the stream context options, the TLS handshake returns the fallback host certificate rather than the client domain certificate.
Wildcard & SAN Verification
Many enterprise clients utilize wildcard certificates (*.codxpert.com) or multi-domain SAN certificates. The engine parses the Subject Alternative Names field to verify exact sub-domain cryptographic bindings.
Intermediate Chain Inspection
If an intermediate CA certificate is missing from the server bundle, desktop browsers may cache it while mobile browsers crash. The checker validates the entire certificate trust chain to the root authority.
Cloudflare & Proxy Pass-Through
For sites routed through Cloudflare edge proxies, the system monitors both the public edge SSL certificate and periodically verifies origin server certificate expiration to prevent silent origin-drop outages.
6. Client Self-Service RBAC & Operational Security
To transform our internal script into a commercial-grade agency platform at ssl.codxpert.com, we implemented strict Role-Based Access Control (RBAC) and security safeguards:
- Granular Multi-Tenant Ownership: Agency clients can register an account, add their own secondary domains, and customize individual notification email lists without seeing other client infrastructures.
- Manual Administrator Verification: To prevent abuse and spam domain lookups, new client registrations pass through an administrative approval pipeline managed directly by our technical team.
- Rate-Limiting & Anti-DDoS Sockets: The public lookup endpoint implements Redis-backed token bucket throttling, preventing external scraping or resource exhaustion.
- Encrypted Webhook Dispatchers: In addition to SMTP emails, high-urgency alerts are dispatched via encrypted HMAC webhooks directly into agency Slack and Discord operational channels.
Need an Automated Monitoring Architecture for Your Brand?
At CodXpert, we design and build custom internal operational portals, automated cron monitoring engines, and scalable web architectures.
