Let's Encrypt stopped sending expiry emails
Your certificate will expire.
We warn you before it does.
Since June 2025, Let's Encrypt no longer emails you when a certificate is about to expire — and certificate lifetimes are being cut in half. Certificate Checker watches your domains around the clock and notifies you long before visitors see a browser warning.
Check a certificate right now
Free, no account needed. We store nothing.
The emails stopped. The deadlines doubled.
Two changes at Let's Encrypt quietly made certificate monitoring everyone's own responsibility.
No more expiration emails
On June 4, 2025, Let's Encrypt stopped sending expiration notification emails — for privacy reasons and tens of thousands of dollars in yearly cost. Their own advice: use a third-party monitoring service. That service is Certificate Checker.
Certificate lifetimes cut in half
Let's Encrypt is reducing certificate validity from 90 to 45 days in stages towards 2028. Renewals will happen twice as often — twice as many moments where something can silently go wrong, without a single warning email.
An expired certificate is not a detail
Browsers greet your visitors with a full-screen warning, and history shows it takes down far more than a landing page.
Equifax, 2017
An expired certificate on a monitoring device left a data breach undetected for 76 days.
Source: Sectigo →Ericsson / O2, 2018
An expired certificate in core network software cut ~32 million customers off 4G for nearly a day.
Source: Encryption Consulting →Microsoft Teams, 2020
Teams went down for hours worldwide because a single certificate quietly expired.
Source: SOCRadar →More reading: Cyber Defense Magazine · EverTrust on certificate outages
Everything a certificate needs a babysitter for
From a single hobby domain to hourly monitoring of your whole portfolio.
Expiry notifications
Alerts by email and in your dashboard — and in Slack or your own webhook on the higher plans — at the thresholds you care about: 28, 14, 7 and 3 days before expiry, and every check once it gets critical.
Expiry dates in your calendar
Subscribe your own calendar to your personal feed and every domain becomes an all-day event on its expiry date — renewals move it automatically. On every plan.
Scheduled checks
Automatic checks around the clock — daily on the free plan, up to every hour on the biggest plans.
Multiple domains
Monitor your whole portfolio in one dashboard, with per-domain status at a glance.
Bulk import
Paste a list of hostnames, get a validated dry run first, and import them all in one go.
Check history
A days-until-expiry chart per domain and a dashboard overview of how many domains sit at each expiration level.
Custom thresholds
Tune when each warning level fires — per account, tailored to your renewal process.
Uptime checks
We ping every domain up to once a minute and alert you the moment it goes down — and again when it recovers, with the outage duration.
Instant live check
Check any domain on demand, straight from the dashboard or right here on this page.
Multi-server aware
CDNs serve different certificates per node. We track the worst case a visitor can hit.
Privacy-friendly by design
European hosting, cookieless statistics on our own Matomo, and never a script on your site.
Plans that scale
Start free, upgrade for more domains, faster checks and longer history. Higher plans add custom thresholds, Slack & webhook notifications, API access and the Terraform & OpenTofu provider.
Smarter than a simple checker
Big sites serve more than one certificate. We know.
Behind a CDN, every server node can hold its own certificate with its own renewal date — we have seen six different certificates on one domain, expiring months apart. A naive checker hits a random node every time and jumps between values, warning you at all the wrong moments.
Certificate Checker tracks the lowest value seen in the last 24 hours: the worst case an actual visitor can hit. Stable, honest, and configurable per account or per domain if you prefer to follow the latest measurement.
Automate it with the API
Everything on your dashboard is also a JSON call away. Create a personal access token under Settings → API tokens and plug your certificate status into your own dashboards, monitoring and scripts.
- Read your domains and their expiry status on the Expert plan and up
- Add and remove domains on the Business and Unlimited plans — ideal for automation
- Official Terraform & OpenTofu provider — declare your monitored domains as infrastructure-as-code
- Scoped bearer tokens you can revoke at any time, rate-limited per account
$ curl https://certificate-checker.com/api/v1/domains \
-H "Authorization: Bearer <your-token>" \
-H "Accept: application/json"
{
"data": [
{
"id": "01983e9c-2f4a-7cde-b1a2-9f3d8c6e5b4a",
"hostname": "example.com",
"days_until_expiration": 54,
"level": "info",
"uptime_enabled": true,
"uptime_status": "up",
"last_checked_at": "2026-07-29T06:20:11+00:00"
}
]
}
$ curl -X POST https://certificate-checker.com/api/v1/domains \
-H "Authorization: Bearer <your-token>" \
-H "Accept: application/json" \
-d "hostname=example.org"
# A domain that serves no website? Turn its uptime checks off:
$ curl -X PATCH https://certificate-checker.com/api/v1/domains/<id> \
-H "Authorization: Bearer <your-token>" \
-H "Accept: application/json" \
-d "uptime_enabled=false"
# Or declaratively, with Terraform / OpenTofu:
resource "certificatechecker_domain" "site" {
hostname = "example.org"
uptime_checks = false
}
Your data stays in Europe. Your visitors stay yours.
Privacy here is not a promise but a set of choices, and every one of them is checkable.
Hosted in Europe
Our servers and databases run at Hetzner in Germany, and our invoicing and payment providers are Dutch.
Statistics on our own Matomo
Cookieless, with shortened IP addresses and Do Not Track respected. No Google Analytics, no third-party trackers.
No cookie banner
Nothing to refuse: the only cookies we set are the session and security cookie you need to log in.
No script on your site
We only open the public TLS connection your visitors do. Nothing to install, and no data about them ever reaches us.
Read it for yourself in our Privacy statement and our Cookie statement.
Simple pricing, straight from the product
Start free, or try any paid plan free for 30 days.
Upgrade when your portfolio — or your paranoia — grows.
Signing up is by invitation at the moment.
Have a signup code? Choose your plan below and fill the code in when you register.
Pro
Popular€5.00 €6.05 / month
30-day free trial included
- 10 domains
- Checked every 12 hours
- Uptime checks every 30 minutes
- 90 days of history
- On-demand rechecks
Expert
€10.00 €12.10 / month
30-day free trial included
- 25 domains
- Checked every 6 hours
- Uptime checks every 15 minutes
- 180 days of history
- On-demand rechecks
- Slack & webhook notifications
- API access
Business
€15.00 €18.15 / month
30-day free trial included
- 50 domains
- Checked every 3 hours
- Uptime checks every 5 minutes
- 365 days of history
- On-demand rechecks
- Slack & webhook notifications
- API access
- Manage domains via the API
- Terraform & OpenTofu provider
- Custom notification thresholds
Unlimited
€25.00 €30.25 / month
30-day free trial included
- Unlimited domains
- Checked every hour
- Uptime checks every minute
- Unlimited history
- On-demand rechecks
- Slack & webhook notifications
- API access
- Manage domains via the API
- Terraform & OpenTofu provider
- Custom notification thresholds
Frequently asked questions
How does the checking work?
We open a TLS connection to your domain on port 443 — exactly like a browser does — check the certificate and record the expiry date. No agents, no DNS changes, no access to your servers needed.
When do I get notified?
By default at 28, 14, 7 and 3 days before expiry, the moment a threshold is crossed. Below the critical threshold you are warned on every check until it is fixed, and you also get a confirmation when a certificate is renewed. On the Business and Unlimited plans you can tune the thresholds yourself.
Can I get alerts in Slack or my own tooling?
Yes. On the Expert plan and up you add a Slack incoming-webhook URL or a webhook endpoint of your own to your profile. Every alert we mail is also delivered there — as a color-coded Slack message that names the domain, how urgent it is and the facts behind it, with a button straight to the dashboard, and as an HTTP POST with a JSON payload (hostname, days until expiry, level, check timestamp) for your own tooling. Both come with a one-click test button.
Can I see the expiry dates in my calendar?
Yes, on every plan. Create your personal feed URL under Settings → Calendar feed and subscribe Google Calendar, Apple Calendar, Outlook or any other calendar app to it. Every domain becomes an all-day event on the day its certificate expires, and a renewal moves the event automatically. Calendar apps refresh a subscribed feed on their own schedule — typically somewhere between a few hours and a day — so see the feed as an overview; the notifications remain the alert.
Is there an API?
Yes. On the Expert plan and up you create personal access tokens under Settings → API tokens and read your domains with their expiry status as JSON. On the Business and Unlimited plans you can also add and remove domains through the API — by hand, or declaratively with our official Terraform/OpenTofu provider (ekstra-software/certificatechecker in the registry). See the API section above for example requests.
Do you also check whether my site is up?
Yes. Every plan includes uptime checks: we request your site over HTTPS — hourly on the free plan, up to every minute on the biggest plans — and alert you when it is unreachable, and again when it recovers, including how long the outage lasted. An outage only counts after a couple of confirming probes, so one hiccup never wakes you up. Certificate problems are reported by the certificate checks, not as downtime, so you always know which of the two is wrong. You can turn uptime checks off per domain for hosts that do not serve a website.
Where does my data live, and do you track my visitors?
Our servers and databases run at Hetzner in Germany, and invoicing and payments are handled by Dutch providers; only our outgoing mail runs through Proton in Switzerland, a country the European Commission has ruled offers an adequate level of protection. We measure page views with our own Matomo installation — cookieless, with shortened IP addresses and Do Not Track respected — so there is no Google Analytics, no third-party tracker and no cookie banner to click away. Checking a certificate only opens the public TLS connection to your domain: we never place a script on your site and never see who visits it. It is all spelled out in our Privacy statement and our Cookie statement.
Can I try a paid plan before paying?
Yes. Pick any paid plan when you register and you get it free for 30 days, no billing details needed up front. Fill them in before the trial ends to continue as a paid plan, or do nothing and your account simply drops to the free Hobby plan — nothing is ever invoiced without warning. Domains above the Hobby limit stay in your account, but only your three oldest keep being checked. Switching plans during the trial is free, and the trial is one-time per account.
Can I change my plan later?
Yes. Pick a different plan under Settings → Plan in the dashboard and it takes effect immediately — plans are invoiced per full month, and the unused part of your previous plan is settled as credit on your upcoming invoices. Upgrading to a paid plan only asks you to complete your billing details first.
Where do I find my invoices?
Every invoice is emailed to you, and under Settings → Invoices in the dashboard you see them all with their current payment status and can download the PDF at any time. Open invoices can be paid online right from that page (iDEAL and other methods).
What happens if an invoice goes unpaid?
Nothing dramatic at first: the payment term is 14 days, you get a reminder by mail the day after the due date and again after two weeks, and the dashboard shows a banner. Only when an invoice is still unpaid 30 days after its due date — announced by mail a week ahead — do your checks and notifications pause, and the dashboard and API close until it is paid. Your account, domains and history stay untouched. Pay online and everything resumes right away.
Why does the dashboard show a different number of days than my browser?
Large sites behind a CDN serve a different certificate per server node, with renewal dates that can be months apart. Your browser sees one random node; we track the lowest value observed in the last 24 hours — the worst case a visitor can actually hit. You can switch to 'latest check' per account or per domain if you prefer.
What happens when a certificate actually expires?
Browsers show your visitors a full-screen security warning instead of your site, APIs start failing TLS handshakes, and trust takes a hit. That is precisely the moment we are built to prevent — you will have been warned for weeks by then.
Do you support certificates from any provider?
Yes. We read whatever certificate your server presents — Let's Encrypt, Sectigo, DigiCert, your internal CA. If it is served on port 443, we can monitor it.
How is this different from just calling openssl in a cron job?
That cron job is also a certificate you have to babysit. We add threshold notifications, renewal detection, multi-server awareness, history charts, bulk import and a dashboard — and we are already watching when your cron host is the thing that broke.
Never miss an expiry again
Three domains, checked daily, free forever. Set up in two minutes.
Create your free account