← Blog  ·  October 2026

SSL Certificate Renewal Reminder: Set It Up Before It’s Too Late

Three concrete methods for making sure your next renewal is never a surprise.

The frustrating part is that SSL certificate renewal reminders should be a solved problem. Yet every week, production sites go down because a cert slipped through — the calendar reminder was on a laptop that got wiped, the cron job was on a server that got rebuilt, or the engineer who owned the task left the company.

This guide covers three practical methods for setting up SSL cert expiry reminders, from a five-minute DIY approach to fully automated alerting. Pick the one that matches your infrastructure and the number of domains you manage.

Why Reminders Fail More Often Than You Think

Before choosing a method, it’s worth understanding the common failure modes:

• Single-point calendar reminders — tied to one person, lost when that person changes roles, switches devices, or simply misses the notification during a busy week
• Auto-renewal you stopped verifying — Let’s Encrypt auto-renews, but certbot can silently fail for months if port 80 is blocked, DNS changes, or nginx config drifts
• Cron jobs on ephemeral servers — a server rebuild or cloud migration removes the cron job, and nobody notices until the cert expires
• Multiple domains, single reminder — one reminder for 20 domains means losing visibility on which specific cert is about to expire

The common thread: a reminder that lives in one place — one calendar, one server, one person’s head — is a single point of failure. The approaches below get progressively more robust.

Where You Stand Right Now

Before setting up any reminder system, check your current certificate expiry dates so you know what you’re working with:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null \
  | openssl x509 -noout -enddate

For a quick days-remaining count:

EXPIRY=$(echo | openssl s_client -connect yourdomain.com:443 2>/dev/null \
  | openssl x509 -noout -enddate | cut -d= -f2)
echo $(( ( $(date -d "$EXPIRY" +%s) - $(date +%s) ) / 86400 )) days remaining

Or skip the command line and use the free SSL Certificate Checker to see expiry dates and issuer details instantly.

Method 1: Cron Job with Email Alert

For developers comfortable with a server, a cron job is the fastest DIY path to a reliable SSL cert expiry reminder. The setup takes under 10 minutes.

The Script

#!/bin/bash
# ssl-reminder.sh — sends an ssl certificate alert email when cert expiry is close

DOMAIN="yourdomain.com"
ALERT_DAYS=30
ALERT_EMAIL="you@example.com"

EXPIRY=$(echo | openssl s_client -connect "$DOMAIN":443 -servername "$DOMAIN" 2>/dev/null \
  | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)

if [ -z "$EXPIRY" ]; then
  echo "SSL reminder: could not retrieve cert for $DOMAIN" \
    | mail -s "SSL check error: $DOMAIN" "$ALERT_EMAIL"
  exit 1
fi

EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s 2>/dev/null \
  || date -j -f "%b %d %T %Y %Z" "$EXPIRY" +%s)
DAYS_LEFT=$(( (EXPIRY_EPOCH - $(date +%s)) / 86400 ))

if [ "$DAYS_LEFT" -le "$ALERT_DAYS" ]; then
  echo "SSL certificate for $DOMAIN expires in $DAYS_LEFT days ($EXPIRY).
Renew at: https://your-registrar.com
Check current status: https://lior-seats.github.io/ssl-cert-checker/" \
    | mail -s "⚠️ SSL cert expiry reminder: $DOMAIN ($DAYS_LEFT days)" "$ALERT_EMAIL"
fi

Scheduling It

Run it daily at 9am so you see the alert at the start of your workday:

0 9 * * * /path/to/ssl-reminder.sh

For multiple domains, run the script once per domain or loop through a list:

#!/bin/bash
DOMAINS=("yourdomain.com" "api.yourdomain.com" "staging.yourdomain.com")
ALERT_DAYS=30
ALERT_EMAIL="you@example.com"

for DOMAIN in "${DOMAINS[@]}"; do
  EXPIRY=$(echo | openssl s_client -connect "$DOMAIN":443 -servername "$DOMAIN" 2>/dev/null \
    | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
  [ -z "$EXPIRY" ] && continue
  EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$EXPIRY" +%s)
  DAYS_LEFT=$(( (EXPIRY_EPOCH - $(date +%s)) / 86400 ))
  if [ "$DAYS_LEFT" -le "$ALERT_DAYS" ]; then
    echo "$DOMAIN: $DAYS_LEFT days remaining" \
      | mail -s "⚠️ SSL expiry reminder: $DOMAIN" "$ALERT_EMAIL"
  fi
done

Limitations

• Requires openssl and a working mail command — outbound mail from servers is often blocked or spam-filtered
• Tied to one server — if the server is rebuilt or migrated, the cron job is silently lost
• No visibility into whether the reminder itself is running — a broken cron daemon fails silently

Method 2: Calendar Reminder with Multiple Owners

A calendar reminder isn’t inherently unreliable — a single-person calendar reminder is. The pattern that works is a shared calendar entry with multiple owners and staggered lead times.

How to Set It Up Correctly

1. Find your cert expiry date — use the SSL Certificate Checker or the openssl command above
2. Create a recurring calendar event on a shared team calendar (Google Calendar, Outlook shared calendar, etc.) — not your personal calendar
3. Set three reminders at staggered intervals: 60 days, 30 days, and 7 days before the expiry date
4. Invite at least two people who are responsible for the renewal — primary and backup
5. Include in the event description: the domain name, registrar/CA URL, renewal process steps, and who is responsible

What to Include in the Calendar Event

SSL CERTIFICATE RENEWAL: yourdomain.com
Expiry: [date]
Issuer: [Let's Encrypt / DigiCert / etc.]
Renewal URL: [registrar or CA dashboard link]
Responsible: [primary owner] + [backup owner]
Steps: [link to internal runbook or renewal procedure]
Check current status: https://lior-seats.github.io/ssl-cert-checker/

Limitations

• Requires manual setup per domain — tedious at scale
• Doesn’t adapt if you rotate the cert early or switch CAs
• Still depends on people noticing and acting on calendar notifications
• No programmatic verification that the cert was actually renewed

Calendar reminders work well as a secondary safety net alongside automated monitoring, but they’re not sufficient on their own for production domains.

Method 3: Automated SSL Certificate Alert Email (Recommended)

An automated SSL certificate monitoring tool eliminates the infrastructure dependency problem (cron jobs on servers) and the human dependency problem (calendar reminders people miss). You register a domain once, and the service sends you ssl cert expiry reminders at defined intervals — regardless of what happens to your servers or team calendar.

What Automated Monitoring Provides

• External, independent checking — verifies from outside your infrastructure, so it catches certs even when your server-based checks fail
• Multiple alert windows — get reminded at 60, 30, and 7 days before expiry so you have multiple chances to act
• Multi-domain visibility — manage all certs from a single dashboard rather than tracking per-domain cron jobs
• Detects auto-renewal failures — if certbot stops renewing, the cert expiry date stops advancing; monitoring catches this before it becomes urgent
• No server dependency — alerts keep arriving even if you rebuild infrastructure, switch providers, or your ops team changes

How It Works for Let’s Encrypt Users

This point deserves emphasis: even if you have certbot auto-renewal configured, external monitoring is valuable. Certbot can fail silently. Common failure modes include a blocked port 80, a DNS change that breaks the ACME challenge, or an nginx config change that stops serving the /.well-known/acme-challenge/ path.

External monitoring detects the symptom — the cert’s expiry date stopped advancing — rather than the cause. You get alerted 60 days before expiry rather than on the day your users start seeing browser warnings.

Which Method Should You Use?

The 5-Minute Minimum Setup

If you’re reading this because a cert just expired or is about to expire, here’s the fastest path to getting a reminder in place:

1. Right now: Use the free SSL Certificate Checker to see exactly how many days you have left on each domain you own.
2. Next 5 minutes: Set a calendar reminder on a shared team calendar for 30 days before expiry — invite your backup person.
3. This week: Set up a cron job or automated monitoring so the reminder is no longer dependent on a single calendar entry.

The goal isn’t a perfect system — it’s a system that has at least two independent paths to alerting you. A cron job plus a shared calendar reminder is significantly more reliable than either alone. Automated external monitoring plus a calendar backup is more reliable still.

Summary

SSL certificate renewal reminders are simple in concept and routinely missed in practice. The key points:

1. Audit your certs now — use the free SSL checker to see what expires and when before you set up any reminder system.
2. Never rely on a single reminder — one calendar entry owned by one person is a single point of failure. At minimum, have two independent paths.
3. Don’t assume auto-renewal is working — certbot can fail silently. External monitoring validates the automation is actually renewing, not just scheduled to run.
4. Alert at multiple windows — a 30-day reminder alone leaves you no buffer if renewal takes longer than expected. 60, 30, and 7 days gives you multiple opportunities to act.