SSL certificate monitoring
A daily check of the certificate your server actually serves. Expiry alerts tuned for 90-day certificates, a watch on certificate transparency logs, and an email, Slack or Discord message before visitors see a browser warning.
Up to 25 domains, no card. Want a one-off look first? Check a certificate now.
No alert at 60 or 30 days: a healthy certbot renews at 30, so those would fire every cycle.
What gets checked every day
The check opens a TLS connection to port 443 the way a browser does and reads what comes back - not a CA dashboard, not a file on disk.
Thresholds that fit short-lived certificates
The defaults are 60, 30, 14, 7 and 1 days before expiry. Any threshold at or above a third of the certificate's lifetime is skipped: an auto-renewed certificate crosses it every cycle, and an alert that always fires is an alert nobody reads.
| Certificate | Alerts at |
|---|---|
90-day ACME certificate Let's Encrypt, ZeroSSL, Google Trust Services |
14, 7 and 1 days left |
200-day certificate Most public certificates issued since March 2026 |
60, 30, 14, 7 and 1 days left |
398-day certificate Issued before March 2026, still in service |
60, 30, 14, 7 and 1 days left |
Thresholds are editable per domain. Public certificate lifetimes drop to 100 days in March 2027 and 47 days in March 2029; the rule above keeps up without a settings change.
Alerts where you already look
- Email to a confirmed address, with one-click unsubscribe
- Slack and Discord webhooks, set per domain, with a test button
- One alert per event: repeats are held back for 24 hours
- Mute a domain for 1 hour, 4 hours, 24 hours or 7 days
- A weekly Monday digest of everything that changed
Why not rely on auto-renewal?
Auto-renewal fails quietly. These are the usual ways a certificate expires on a server that "renews automatically":
- The renewal cron stopped after a server move or runs as the wrong user
- HTTP-01 or DNS-01 validation broke after a DNS or CDN change
- The new certificate is on disk, but nginx was never reloaded
- One origin behind the load balancer still serves the old one
A status badge for your README
Every domain gets a live SSL badge, refreshed hourly. It links to the public audit page.
[](https://dombrains.com/d/example.com)
Questions
›How often is the certificate checked?
Once a day at 06:00 UTC, together with the rest of the domain's checks. The domain page also has a Run checks now button, available once every 15 minutes.
›Will I get an alert every time certbot renews a 90-day certificate?
No. A threshold at or above a third of the certificate's lifetime is skipped, because an auto-renewed certificate crosses it on every cycle. A 90-day certificate alerts at 14, 7 and 1 days left - by then certbot should have renewed it 16 days ago. The status turns to warning at 14 days for certificates of 100 days or less and at 30 days for longer ones.
›Let's Encrypt stopped sending expiry emails. What replaces them?
Let's Encrypt ended its expiration emails in June 2025. DomBrains reads the certificate your server actually serves on port 443, so it also catches the cases a CA email never could: a certificate that renewed on disk but was never loaded, or one origin behind a load balancer still serving the old one.
›Can I change the alert thresholds?
Yes, per domain: any list of days, for example 45, 21, 7, 2. You can also mute a domain for 1 hour, 4 hours, 24 hours or 7 days, or switch SSL alerts off for it while the other checks keep running.
›Can I monitor subdomains?
Yes. Every hostname is saved on its own, so api.example.com and shop.example.com are watched separately. The check connects to port 443 of a public hostname; internal addresses are refused.
›What does the certificate transparency check catch?
Every public certificate is logged in CT logs. Each day DomBrains compares the certificates logged for your domain with the previous day and alerts when a new one appears: a certificate you did not order, a forgotten subdomain, or another team using a different CA.
›How much does it cost?
Nothing during early access: up to 25 domains, every check, email, Slack and Discord alerts. No card.
Add a domain to monitoring
The first check runs right away; after that, every morning at 06:00 UTC.
Further reading: SSL certificate expired - what to do right now, bulk SSL expiry audit, HSTS explained.