SSL monitoring for Let's Encrypt + Cloudflare sites
Cloudflare's Universal SSL covers the edge, but origin Let's Encrypt renewals quietly break when the proxy intercepts the ACME challenge path — a documented pain on Cloudflare's own community forum. ManageCert hits your origin and edge separately, daily, and alerts at 30/14/7/1 days regardless of what Cloudflare's dashboard says.
The recurring Cloudflare-community story: site running for years, Cloudflare proxy enabled, Let's Encrypt renewal cron quietly stops working because the orange-cloud catches the ACME challenge, and 60-80 days later the cert expires. The user's first signal is a customer screenshot of a browser warning. ManageCert is the independent eye that catches the broken renewal cycle the day it stops.
Why ManageCert for Cloudflare-fronted sites
Catches the LE + Cloudflare proxy failure mode
When you turn the orange cloud on for a domain, Cloudflare's edge intercepts /.well-known/acme-challenge/ and your origin renewal silently fails. We see the cert that visitors actually get, so we surface this 50+ days before expiry.
Every hostname, not just the apex
Add api.yourdomain.com, marketing.yourdomain.com, staging subdomains — each checked independently against its own TLS handshake. Cloudflare lumps them in dashboard counters; we surface individual failures.
DNS-change alerts catch dashboard mistakes
If someone toggles proxy off on the wrong record and breaks SNI, we tell you the same day. Mid-night DNS edits are how mail and auth quietly break.
SSL, domain expiry, DNS — daily, across all your domains.
SSL certificates
Expiry, issuer, SANs, chain validity, hostname match. Alerts at 30/14/7/1 days, plus immediate if invalid.
Domain registration
RDAP + WHOIS lookups daily. Alerts at 60/30/14/7 days. Catches lapsed-domain → squatter before it happens.
DNS records
A/AAAA/MX/CNAME/TXT/NS snapshot + diff. Catches mid-night MX flips before mail breaks for a week.
Frequently asked
- Doesn't Cloudflare already email me about cert expiry?
- Sometimes, eventually. Their notification cadence is inconsistent and rarely lands more than a few days out. ManageCert gives you a predictable 30/14/7/1-day schedule on every cert on every domain, regardless of provider.
- Does this work for Cloudflare Pages and Workers too?
- Yes — any hostname that serves HTTPS publicly. We hit port 443 with SNI and read the cert.
Ready to stop worrying?
Solo $19 · Pro $39 · Agency $99 · Studio $249. 14-day free trial. Annual saves 20%.