Never let an SSL silently expire again

The silent outage

Most outages announce themselves. The server stops responding, your uptime monitor pings you, you get a Slack alert at 3 AM. Expiries don't work that way.

An SSL certificate stops being valid at a specific second. The web server keeps serving the request. The TLS handshake fails. The browser shows a red warning page. Your site is technically up. Your monitoring stays green. And the only signal that something's wrong is customer support tickets piling up because nobody can complete a checkout.

Same story for domain expiry, except worse. A lapsed domain doesn't degrade — it reassigns. Your nameservers stop resolving. Email stops delivering. Three weeks later someone else can register it.

We treat both as monitoring problems, not "your responsibility" problems.

What you get

Every GoCelerus plan with a domain attached gets expiry monitoring automatically. No add-on, no separate dashboard:

• SSL certificate expiry — checked daily against your live cert via cPanel. If you use AutoSSL, you'll still get the alert if renewal failed; AutoSSL silently breaks more often than people realise.
• Domain registration expiry — checked daily via RDAP against the registry. Works regardless of where you registered (us, Namecheap, Cloudflare, anywhere).

Alerts fire at four thresholds: 30 days, 14 days, 7 days, and 1 day before expiry. Two channels:

• Email — to the account address. Always on.
• Telegram — sent from your own bot, if you've configured one. Same bot used for uptime alerts. (You bring your own Telegram bot so we never see your messages — we just sendMessage through your bot's API token.)

How it's smart about renewals

The naive way to schedule alerts is: "fire at day-30, then day-14, etc." That breaks the moment a customer renews. The renewal pushes the expiry date out 12 months, the system thinks the day-14 alert already fired, and it stays quiet through the new cycle.

Our dedup key includes the expiry date itself. When you renew, the expiry date changes, the dedup key changes, every threshold re-arms. Next time we cross 30 days out, you get an alert again.

The other failure mode — re-alerting too aggressively — is handled by always picking the smallest threshold that applies. If a cold-start sees a cert expiring in 5 days, you get the 7-day alert (the most urgent applicable), not all four buckets at once.

How to wire the Telegram side (optional)

Email alerts are on by default; the Telegram side is opt-in because we'd rather you own the bot than centralise messaging through us. Five-minute setup:

1. Open @BotFather in Telegram → /newbot → name it → copy the token.
2. Open @userinfobot → it tells you your chat ID.
3. In your GoCelerus account, go to Account → Monitoring → paste both → Save.
4. Click Send Test to confirm the bot can DM you.

That same bot configuration also drives uptime alerts (Module 5.18 monitoring) and is the only place you'll configure Telegram for the platform. One bot, every notification stream.

What we don't do

• We don't auto-renew domains for you. Renewal is a registrar action and we don't sit between you and your registrar. The alert tells you it's time; the action is yours.
• We don't auto-renew SSL certs you bought elsewhere. AutoSSL via WHM handles itself; manually-installed Let's Encrypt or commercial certs are your install to maintain. The alert tells you what needs attention.

Already running on production today

This shipped in mid-May 2026, runs daily at 08:30 Asia/Jakarta, and has already caught two production SSLs that were two weeks from a silent failure. The whole pipeline reuses our existing WHM SSL fetcher and our RDAP cache from the WHOIS surface — no new external dependency.

The cheapest outage is the one you knew about three weeks in advance.