SSL Expiry Alert: Get Notified Before Your Certificate Expires

October 2026 · 7 min read

An expired SSL certificate turns your site into a red warning screen for every visitor. Browser warnings, zero organic traffic, broken API calls, and failed payment flows — all because you missed an SSL expiry alert that got buried in spam, or never set one up in the first place.

The fix is straightforward: configure automated SSL expiry alerts at 30, 14, 7, and 1 day before your certificate expires. This guide covers every method — from a one-line shell command to fully automated monitoring services — so you can choose the approach that fits your stack.

Why SSL Expiry Alerts Matter

Before setting up alerts, it helps to understand the exact failure chain when a certificate expires:

• Browser block pages — Chrome, Firefox, and Safari show a full-page "Your connection is not private" warning. Most visitors click away immediately; Google Search Console starts logging certificate errors.
• SEO damage — Google deranks HTTPS sites returning certificate errors. Recovery takes weeks after renewal, not hours.
• API failures — Mobile apps, third-party integrations, and webhooks making HTTPS calls to your endpoints will fail with certificate validation errors.
• Blocked payments — Stripe and other payment SDKs verify the full SSL chain. An expired cert prevents checkout.
• Email deliverability — If your mail server certificate expires, outbound mail may fail SPF/DKIM validation.

Step 1: Check Your Current Expiry Date

Before configuring alerts, find out how much time you have right now.

Browser method

Click the padlock icon in Chrome → "Connection is secure" → "Certificate is valid" → look for the expiry date under "Valid to".

Command line (openssl)

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null \
  | openssl x509 -noout -dates

Output:

notBefore=Sep  5 00:00:00 2026 GMT
notAfter=Dec  4 23:59:59 2026 GMT

Free online checker

Paste any domain into a free SSL checker for instant results — days remaining, issuer, and validity status — without opening a terminal.

Method 1: Shell Script + Cron

For teams comfortable with the command line, a cron-scheduled shell script is the lowest-cost DIY SSL expiry alert:

#!/bin/bash
DOMAIN="yourdomain.com"
THRESHOLD=30
ALERT_EMAIL="you@yourcompany.com"

EXPIRY=$(echo | openssl s_client -connect $DOMAIN:443 -servername $DOMAIN 2>/dev/null \
  | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)

EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$EXPIRY" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))

if [ $DAYS_LEFT -le $THRESHOLD ]; then
  echo "SSL certificate for $DOMAIN expires in $DAYS_LEFT days ($EXPIRY)" \
    | mail -s "⚠️ SSL expiry alert: $DOMAIN" $ALERT_EMAIL
fi

Schedule it in cron to run daily at 9 AM:

0 9 * * * /usr/local/bin/ssl-expiry-check.sh

Run a variant with different THRESHOLD values (30, 14, 7, 1) to get multi-stage alerts.

Method 2: Uptime Monitor with SSL Checks

General uptime monitoring tools like UptimeRobot and StatusCake include SSL expiry checks as a feature. Setup is usually a few clicks: add your domain, enable SSL monitoring, set the alert threshold.

The main limitation: free tiers typically alert only at 7 days, which isn't enough lead time for domains with slow approval processes (OV/EV certificates) or for teams where certificate renewal requires change-management approval.

Method 3: Dedicated SSL Expiry Alert Service (Recommended)

A dedicated SSL monitoring service checks your certificates daily and fires alerts at every threshold automatically. No cron job, no script maintenance, no MTA configuration.

What to look for

Setting the Right Alert Thresholds

The key lesson from teams that have experienced SSL outages: a single alert isn't enough. Here's what each threshold is actually for:

• 30 days — add to the backlog; no urgency, but the clock is ticking. Useful for OV/EV certs with multi-day approval queues.
• 14 days — schedule the renewal this week. If you're using certbot, investigate why auto-renewal hasn't fired yet.
• 7 days — renew today. Don't wait for tomorrow's standup.
• 1 day — emergency renewal. Wake the on-call engineer. Your cert expires at midnight.

SSL Expiry Alerts for Domains You Don't Control

Expiry monitoring matters beyond your own servers:

• Third-party APIs — your integration breaks if their cert expires, even if your own certs are fine
• CDN endpoints — Cloudflare, Fastly, and others occasionally miss cert rotations on custom domains
• Client domains — agencies and freelancers should monitor all client sites and receive the expiry alert with enough time to coordinate renewal
• Partner webhooks — a webhook receiver with an expired cert silently drops all events

Independent monitoring covers all of these — no server access required, just the domain name.

What to Do When You Receive an SSL Expiry Alert

If you manage the certificate yourself

1. Log in to your CA or hosting panel and initiate renewal
2. For Let's Encrypt: run sudo certbot renew --dry-run to confirm auto-renewal works, then sudo certbot renew
3. Verify the new expiry with openssl s_client or a free checker tool
4. Confirm the alert stops arriving on the next daily check

If a third-party controls the certificate

1. Contact the domain/service owner immediately with the expiry date
2. Include the openssl output or checker result as evidence
3. Follow up — expiry alerts that go to the wrong inbox expire silently

Summary

An SSL expiry alert is one of the highest-ROI monitoring actions you can take — configure it once, and you eliminate an entire category of avoidable outage. Set multi-threshold alerts (30/14/7/1 days), cover all your domains including external ones, and verify that your renewal process actually works by watching the live certificate, not your certbot logs.