SSL certificate expiration is one of the most preventable outages in software. The expiry date is stamped in the certificate itself — you can read it at any time. And yet teams get caught by it constantly, because there's no built-in alarm. The cert silently ticks toward expiration, and the first signal most teams get is a browser error page.
This article covers five free approaches to SSL certificate monitoring, from quick manual checks to automated alerting, including our free SSLWatch tool that requires no signup to use.
Let's Encrypt certificates expire every 90 days. Traditional CA certificates typically expire every 1–2 years. In either case, the failure mode is the same: the renewal process breaks at some point — a cron job that stopped running, an ACME challenge that started failing, a DNS change that broke auto-renewal — and nobody notices until the cert is already expired.
The problem is compounded by two factors:
example.com may forget that api.example.com has its own cert on a different renewal schedule.Here are five free methods to close the gap.
Every browser shows certificate details including the expiry date. In Chrome: click the padlock icon → Connection is secure → Certificate is valid. In Firefox: padlock → Connection secure → More information → View Certificate.
This works for one-off checks, but it requires someone to remember to check, which is why it fails in practice. Use it as a quick diagnostic when you suspect an issue — not as ongoing monitoring.
# Quick check from the terminal — shows notAfter date
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -datesThis prints the notBefore and notAfter dates for the certificate currently served. Run it on any domain to see exactly when it expires.
Google Search Console sends alerts when it encounters a security issue on your property — including certificate errors. If your cert expires and Googlebot hits the site, you'll receive an email under Security Issues in Search Console.
The limitation: the alert arrives when Googlebot crawls the page after the expiry, not before. This is a reactive notification, not a proactive one. For high-traffic sites that Googlebot crawls frequently, you might hear about it within hours of expiry. For low-traffic sites, it may take days.
Google Search Console is worth having regardless — it covers many security issue types beyond SSL — but it should not be your primary SSL expiry monitor.
If you issued your certificate through Let's Encrypt, they send expiry reminder emails at 20 days and 7 days before expiration — but only if auto-renewal hasn't already renewed the cert. The email goes to the address you provided during the initial ACME registration.
Check which email your certs are registered under:
# Find the registered email for a Certbot-managed cert
sudo certbot certificatesThis works reliably for domains managed by Certbot, but has two gaps:
UptimeRobot's free tier includes SSL certificate monitoring. After adding a monitor for your domain, it checks your cert's expiry and sends an email alert when the cert is within a configurable threshold (default: 7 days).
Setup: create a free account → Add New Monitor → HTTPS → enter your domain → expand SSL settings → enable SSL alert.
The free tier covers up to 50 monitors, which is sufficient for most teams. The main limitation is that free-tier check frequency is 5 minutes for uptime, and SSL checks are less frequent than uptime checks — typically daily. This is fine for expiry alerts, since you have a 7-day window, but it means you won't catch mid-cert issues in real time.
The fastest way to check any domain's SSL status right now is our free SSL certificate checker. Paste any domain, get the expiry date, issuer, and days remaining — no account required.
Use it for:
www, api, app, and cdn subdomains, each may have its own certificate. Run the checker against each one. It's common to have the main domain monitored but forget a subdomain that's on a different cert with a different renewal schedule.
If you're not currently monitoring SSL expiry, here's a quick triage:
sudo certbot renew --dry-run. If it fails, fix it before the cert expires.The entire triage takes under 20 minutes and eliminates a class of outage that's entirely preventable.
For teams managing 1–3 domains: Let's Encrypt emails + UptimeRobot free tier covers you at zero cost. For teams managing 10+ domains across multiple platforms: a dedicated SSL monitoring service that polls all domains on a schedule and sends a single alert digest is worth the time investment. Our SSLWatch tool is designed for exactly this — add all your domains, get notified before any of them expire.
SSLWatch monitors all your certificates in one place and sends alerts before any of them expire — across apex domains, subdomains, APIs, and CDN endpoints. Add all your domains in minutes.
Join the SSLWatch waitlist → Check a cert now (free)