An expired SSL certificate is one of the few SEO disasters worse than a misconfigured robots.txt. Chrome blocks the page with a full-screen warning. Search Console flags it as a security issue. Organic traffic vanishes for as long as it takes ops to renew — typically a business day, sometimes longer when auto-renewal silently fails.
Step 1. Add every subdomain to SSL monitoring
Site → SSL is on by default in every 2-UA project.
For multi-domain teams, add every subdomain:
api., blog., app., status..
Auto-renewal misses non-www subdomains more often than teams expect.
Step 2. Configure alert windows
Default thresholds: 30, 14, 7, and 1 days before expiration. For mission-critical sites, add a 60-day renewal-start reminder routed to your DevOps channel. A 60-day heads-up lets ops handle renewal during normal hours, not at 2 AM after an outage.
Step 3. Monitor more than just expiration
2-UA checks the full TLS posture, not just the expiration date:
- Certificate chain validity — broken intermediates render as untrusted in some browsers.
- Mixed-content warnings — HTTP assets on HTTPS pages.
- Self-signed certs on subdomains — usually staging environments leaking into prod DNS.
- Weak ciphers — TLS 1.0 and 1.1 still served signal poor security hygiene to Google.
Step 4. Route SSL alerts into your incident workflow
Route alerts to Slack with @here, Telegram, or a PagerDuty webhook.
SSL is the rare SEO check that is also an uptime check.
Treat it as a tier-1 incident signal.
Three classes of silent SSL failures
- Let's Encrypt auto-renewal failure — silent until 7 days before expiry; usually caused by changed permissions on the ACME challenge directory.
- Wildcard cert not covering new subdomain —
*.example.comdoes not cover*.sub.example.com. - CDN cert valid, origin cert expired — both must be valid; checking only the public URL misses the origin.
HTTPS as a baseline, not an advantage
HTTPS has stopped being a ranking advantage; the penalty for not having it dwarfs any uplift. The risk profile is asymmetric — perfect TLS earns nothing, broken TLS costs everything. Continuous monitoring is therefore not optional; it is the floor of acceptable infrastructure hygiene for an SEO-dependent business.
Add your domain to a free 2-UA project for combined SSL, domain, and certificate-chain monitoring across every subdomain you own.