Domains: Uptime, SSL and Registration Expiry
Three separate concerns per domain, alerting independently. The certificate check costs nothing because the uptime poll already reads it.
A domain record bundles three things that break independently: whether the site responds, when the TLS certificate expires, and when the registration lapses. Each alerts on its own, because a domain can be down and certificate-expiring at the same time and both need saying.
This is the only module in SensaCat that polls outward. Everything else waits for your systems to report in; here we make the request.
Uptime polling
Checks run every 5 minutes on Team and Enterprise, and every 15 minutes on Free and Starter. The interval is plan-gated because this is the one component whose infrastructure cost scales with customer count rather than staying flat, and we would rather be straightforward about why than invent a feature justification.
A domain needs two or more consecutive failures before it flips to down. A single failed check is usually a network blip, and alerting on one would generate noise that trains people to ignore the channel.
SSL rides along for free
The certificate expiry date is presented during the TLS handshake, so the same HTTPS request that checks whether your site is up also reads the certificate. There is no separate check to configure and no additional cost, which is why we do not treat it as a premium feature.
A machine-verified certificate date is distinguished from a manually entered one, so you can tell at a glance whether a date came from the live endpoint or from somebody typing it in.
This matters more in 2026 than it used to. The CA/Browser Forum cut the maximum certificate lifetime from 398 days to 200 on 15 March 2026, dropping to 100 days in 2027 and 47 in 2029. Renewal processes built around an annual cycle are now exercised twice as often.
Registration expiry is manual
Being direct: there is no WHOIS integration. Registration expiry dates are entered by hand and tracked with date arithmetic, the same way credentials are.
Automated WHOIS lookup is on the roadmap and is not built today. If automatic registry checking is a requirement, weigh that before choosing us.
The date still matters enormously. A lapsed domain moves through an auto-renew grace period of up to 45 days, then a 30-day redemption period where recovery costs a restore fee rather than a renewal, then five days of pending delete after which it is gone.
Three concerns, three alert types
| Concern | How it is checked | Alert source type |
|---|---|---|
| Uptime | Outbound HTTPS poll, 5 or 15 min | domain_uptime |
| SSL expiry | Read from the same poll's TLS handshake | domain_ssl |
| Registration expiry | Manual date, checked daily | domain_registration |
Keeping these as three separate alert types rather than one domain alert means a certificate expiring while the site is already down produces two alerts, each resolvable independently. Collapsing them into one would hide the second problem behind the first.
Reminder zones for both expiry dates
Registration and SSL use the same escalating zones as credentials, tracked independently because they move on different schedules. A certificate renewing every 200 days and a registration renewing every year do not need to be reminded about together.
| Days until expiry | Severity | Frequency |
|---|---|---|
| 16 to 30 | warning | Once |
| 6 to 15 | critical | Once |
| 5 or fewer, or already expired | critical | Daily |
Plan limits
| Free | Starter | Team | Enterprise | |
|---|---|---|---|---|
| Domains | 1 | 3 | 10 | Unlimited |
| Check interval | 15 min | 15 min | 5 min | 5 min |
| SSL + registration tracking | Yes | Yes | Yes | Yes |
Background: SSL certificate monitoring and domain expiry monitoring. If you are mid-incident, see domain expired without notice.