operate
TLS & Certificate Monitoring
Cipher grade, cert expiry, OCSP, HSTS-preload — an expired cert rolls the release back.
What you get
The whole TLS picture
Cipher grade, certificate expiry, OCSP stapling, HSTS-preload readiness and mixed content — checked on your live endpoint, not guessed from config.
Expired cert, auto-rollback
An expired certificate is treated as critical: the release rolls back on its own, with the reason attached.
Watched after launch, not just at deploy
Certificates expire on a schedule that has nothing to do with your deploy cadence. ZipLoom keeps checking expiry, cipher grade, and OCSP after the app is live, so a cert lapsing three weeks post-launch is caught before browsers start warning your users.
How TLS monitoring works
- 1
ZipLoom inspects the live TLS endpoint after deploy.
- 2
Cipher grade, expiry, OCSP and HSTS-preload are checked.
- 3
A critical finding like an expired cert triggers automatic rollback.
What this check inspects
Certificate expiry, checked continuously after launch rather than once at deploy.
The full chain, including intermediates — a valid leaf with a broken chain still fails in some clients.
Protocol and cipher strength, flagging deprecated TLS versions.
Hostname coverage, including the apex and any subdomains you've attached.
What it means when this fails
An expired certificate takes your app down for everyone at once, with a full-page browser warning that reads as 'this site is dangerous'. It's a scheduled outage you didn't schedule, and it usually happens weeks after launch when nobody is watching the calendar.
Questions
- Doesn't my platform auto-renew?
- Usually — until a DNS change, a domain move, or a failed validation quietly breaks renewal. Monitoring is how you learn before your users do.
- How early is the warning?
- Well before expiry, so there's room to fix a renewal that's failing rather than scrambling on the day.
- Does this cover custom domains?
- Yes — every hostname you've attached is checked, not only the default platform domain.
What it replaces
Better Stack Uptime
Uptime monitoring, on-call and status pages. Tells you it broke; doesn't roll the release back.
Checkly Starter
Synthetic API and Playwright browser checks. Team plan $64/mo for all regions.
Snyk Team
Per contributing developer, 5-seat minimum (~$1,500/yr entry). Code + dependency scanning; does not deploy your app.
ZipLoom Solo — all 28 features included
Deploy, security scan, and monitoring in one flat price. Guild $40/mo · Studio $70/mo · Business $299/mo.
Related features