SSL and TLS problems can appear in two separate places: the daily certificate-expiry result or the normal HTTPS availability check. Start by identifying which one failed because they have different effects.
Identify the affected check
Expiry Monitoring shows an Error when the daily certificate lookup could not retrieve and validate the public certificate. This can queue an expiry error alert, but it does not make the monitor Down.
Detailed Logs show an SSL or TLS availability failure when the normal HTTPS request could not establish a trusted secure connection. After the standard consecutive and regional confirmation process, that can make the monitor Down and create an availability incident.
Common causes
| Cause | What to check |
|---|---|
| Expired certificate | Confirm the certificate currently served by the public endpoint, not only the renewed certificate in your provider dashboard. |
| Hostname mismatch | Confirm the certificate covers the exact monitored hostname, including the required www or subdomain name. |
| Incomplete certificate chain | Install the required intermediate certificates and retest from outside your server. |
| Untrusted certificate | Replace self-signed, private, or otherwise untrusted certificates on public customer endpoints. |
| Wrong certificate served | Check virtual-host, load-balancer, CDN, proxy, and Server Name Indication configuration. |
| Port 443 unavailable | Confirm the firewall, origin, load balancer, and hosting service accept public HTTPS connections. |
| TLS handshake failure | Review supported TLS protocols, ciphers, proxy settings, and edge-provider logs. |
| Renewal not deployed everywhere | Check every CDN edge, load balancer, and origin that can answer for the hostname. |
Compare monitoring with your browser
A browser can appear healthy because it reached a different edge location, reused a connection, or followed a cached route. Test the exact monitored URL from a private browser session and compare the certificate subject, issuer, and expiry date.
Do not bypass a certificate warning just to make the page load. That confirms the connection is not trusted normally.
Use incident diagnostics
For a confirmed availability incident, review the TLS diagnostic card and select View full diagnostics. It can show authorization state, protocol, cipher, certificate subject, issuer, expiry, and errors captured near the incident.
Diagnostics are supporting evidence, not a guaranteed internal root cause. Compare them with CDN, load-balancer, firewall, hosting, and server logs from the same time.
After making a correction
Availability monitoring can recover after the next successful scheduled result. Optional expiry monitoring updates on its next approximately daily run.
If you renewed the certificate, verify that the public endpoint now presents the new expiry date. Renewing it in a control panel is not enough if the older certificate is still deployed.
If only Uptime Basics fails
Check for TLS rules, firewalls, bot controls, or regional policies that treat external monitoring differently. Confirm the hostname resolves publicly and that port 443 is reachable from outside your network.
If the issue continues, contact support with the monitor name, incident or check timestamp, displayed error, and whether the problem affects availability monitoring, expiry monitoring, or both. Never send private keys or passwords.