Understanding SSL Certificate Alerts

What triggers an SSL certificate alert?

Merlonix monitors SSL certificates on all your watched assets and fires alerts when:

• Imminent expiry: Certificate expires within 30 days (warning) or 7 days (critical)
• Issuer change: The certificate authority changes unexpectedly
• SAN mismatch: Subject Alternative Names change (domains added or removed)
• Key downgrade: Key algorithm or size weakens (e.g. RSA-4096 → RSA-2048)
• Signature algorithm change: e.g. SHA-256 → SHA-1

What should I do when I receive an alert?

For expiry alerts: renew your certificate with your CA or hosting provider. Most providers allow renewal 30 days before expiry without gap.

For issuer change alerts: verify with your team whether a CA migration was planned. If unexpected, treat as a potential security incident.

For SAN change alerts: check whether the change was intentional (adding a new subdomain) or unexpected (possible certificate mis-issuance).