Free
$0 / month
Free, no card needed
- 50 domains
- Checks every 24 hours
- Email and Telegram alerts
- Expiry, outage and certificate change alerts
- No API access
SSL certificate monitoring In development
SSL certificate monitoring that warns you before anything breaks
Add your domains once. ssl.sh checks every certificate on a schedule and alerts you 30, 14, 7, 3 and 1 days before it expires, when TLS on a host stops working, and when a certificate is replaced.
ssl.sh Monitor is in development and not open for sign-up yet. Plans and prices on this page may change before launch.
Why certificate monitoring matters more now
Certificates are getting shorter, and the reminder emails are gone. Let's Encrypt stopped sending expiration notification emails on June 4, 2025. Until then, many site owners only learned that renewal had silently failed because of those emails.
At the same time, the CA/Browser Forum adopted Ballot SC-081, which reduces the maximum lifetime of publicly trusted TLS certificates in steps:
| From | Maximum certificate lifetime |
|---|---|
| March 15, 2026 | 200 days |
| March 15, 2027 | 100 days |
| March 15, 2029 | 47 days |
Let's Encrypt is moving faster on its own default certificates: 64 days from February 10, 2027 and 45 days from February 16, 2028. See the certificate validity timeline and the Let's Encrypt timeline for details.
Shorter lifetimes mean more renewals, and every renewal is a chance for automation to break: an expired DNS API token, a firewall rule that blocks HTTP-01 validation, a load balancer still serving the old certificate. Monitoring the certificate your server actually presents catches all of these, along with missed renewal jobs.
If you want a one-off check right now, use the SSL checker. To understand why renewals fail, read how to automate certificate renewal.
What ssl.sh Monitor watches
Expiry countdown
Alerts at 30, 14, 7, 3 and 1 days left by default, and you can pick your own thresholds. Each threshold fires once per certificate, so a renewed certificate starts a fresh countdown.
Outages and recovery
Handshake failures, untrusted chains, hostname mismatches and connection errors. A host must fail two checks in a row before it counts as down, and you get a recovery notice when it passes again.
Certificate replacement
When the serial number changes, you get an informational alert with the new issuer and expiry date, so an unexpected renewal or a different CA never goes unnoticed.
New certificates in CT logs
Pro and Team plans also watch Certificate Transparency logs and report certificates issued for your hostnames since the last check.
Any port, bulk import
Paste hundreds of hosts at once, one per line, with an optional port such as mail.example.com:465. The dashboard sorts everything by days left.
Status page and API
Pro adds a public status page you can share with customers and an API key with 10,000 requests per day.
Where alerts go
- Telegram
- Webhook
- Slack
- WeCom bot
- Feishu / Lark bot
- DingTalk bot
Each alert run is bundled into one message per account, so a bulk renewal does not flood your chat. Every channel has a Send test button. Failed deliveries are retried once and logged.
Pricing
Pro
$6 / month
or $60 per year
- 500 domains
- Checks hourly
- All channels: email, Telegram, webhook, Slack, WeCom, Feishu, DingTalk
- Expiry, outage and certificate change alerts
- CT log alerts for new certificates
- Public status page
- API: 10,000 requests per day
Team
$29 / month
Billed monthly
- Everything in Pro
- 3,000 domains
- Checks every 15 minutes
- All channels: email, Telegram, webhook, Slack, WeCom, Feishu, DingTalk
- Expiry, outage and certificate change alerts
- CT log alerts for new certificates
- Public status page
- API: 10,000 requests per day
- Up to 10 team members
How it compares with other free options
There are several good ways to watch certificate expiry, and the right one depends on how many certificates you have and where you want alerts.
| Option | Cost | Good fit |
|---|---|---|
| ssl.sh Monitor Free | $0 for 50 domains, daily checks | Small sites that want email or Telegram alerts plus outage and replacement alerts without running anything |
| Red Sift Certificates Lite | Free for up to 250 certificates (as described by Let's Encrypt) | Teams that need to watch more than 50 certificates at no cost and are happy with email notifications |
A cron job with openssl s_client |
Free, self-hosted | One or two servers you already administer, if you are comfortable maintaining the script |
| Prometheus blackbox_exporter | Free, self-hosted | Teams that already run Prometheus and Alertmanager; it exposes probe_ssl_earliest_cert_expiry for alert rules |
Let's Encrypt itself pointed users to Red Sift Certificates Lite when it ended its reminder emails. If you only need expiry emails for many certificates, that is a reasonable choice. ssl.sh focuses on fast setup, Chinese and international chat channels (WeCom, Feishu, DingTalk, Telegram, Slack), outage detection and CT alerts.
FAQ
Does Let's Encrypt still email me before my certificate expires?
No. Let's Encrypt ended its expiration notification emails on June 4, 2025. If your renewal automation fails, nothing from Let's Encrypt will warn you, so you need separate monitoring.
How often does ssl.sh check my certificates?
Every 24 hours on Free, every hour on Pro and every 15 minutes on Team. After a failed check the host is re-checked within about five minutes to confirm the problem before an outage alert is sent.
Will I get the same alert over and over?
No. Each expiry threshold fires once per certificate serial number. Outage alerts fire once when a host goes down and once when it recovers.
Can I monitor mail servers or other ports?
Yes. Add a host with a port, such as mail.example.com:465. Hosts without a port are checked on 443.
Do I need to install an agent or give you server access?
No. ssl.sh connects to your public hostnames the same way a browser does and reads the certificate the server presents. Nothing is installed on your servers.
How do I sign in?
Enter your email address and we send a sign-in link that works once and expires after 15 minutes. There is no password to remember.