# SSL Certificate Expiry Monitoring – Free for 50 Domains

> Monitor SSL/TLS certificate expiry, outages and replacements. Alerts by email, Telegram, Slack, webhook, WeCom, Feishu and DingTalk. Free for 50 domains.

Source: https://ssl.sh/monitor/
Last updated: 2026-11-10

> ssl.sh 监控还在开发中，暂未开放注册。本页的套餐和价格在上线前可能调整。

## Why certificate monitoring matters more now

**Certificates are getting shorter, and the reminder emails are gone.** Let's Encrypt stopped sending expiration notification emails on June 4, 2025. Until then, many site owners only learned that renewal had silently failed because of those emails.

At the same time, the CA/Browser Forum adopted [Ballot SC-081](https://ssl.sh/ballots/sc-081/), which reduces the maximum lifetime of publicly trusted TLS certificates in steps:

| From | Maximum certificate lifetime |
|---|---|
| March 15, 2026 | 200 days |
| March 15, 2027 | 100 days |
| March 15, 2029 | 47 days |

Let's Encrypt is moving faster on its own default certificates: 64 days from February 10, 2027 and 45 days from February 16, 2028. See the [certificate validity timeline](https://ssl.sh/timeline/certificate-validity/) and the [Let's Encrypt timeline](https://ssl.sh/timeline/lets-encrypt/) for details.

Shorter lifetimes mean more renewals, and every renewal is a chance for automation to break: an expired DNS API token, a firewall rule that blocks [HTTP-01](https://ssl.sh/glossary/http-01/) validation, a load balancer still serving the old certificate. Monitoring the certificate your server actually presents catches all of these, along with missed renewal jobs.

If you want a one-off check right now, use the [SSL checker](https://ssl.sh/tools/ssl-checker/). To understand why renewals fail, read [how to automate certificate renewal](https://ssl.sh/learn/automate-certificate-renewal/).


## How it compares with other free options

There are several good ways to watch certificate expiry, and the right one depends on how many certificates you have and where you want alerts.

| Option | Cost | Good fit |
|---|---|---|
| ssl.sh Monitor Free | $0 for 50 domains, daily checks | Small sites that want email or Telegram alerts plus outage and replacement alerts without running anything |
| Red Sift Certificates Lite | Free for up to 250 certificates (as described by Let's Encrypt) | Teams that need to watch more than 50 certificates at no cost and are happy with email notifications |
| A cron job with `openssl s_client` | Free, self-hosted | One or two servers you already administer, if you are comfortable maintaining the script |
| Prometheus blackbox_exporter | Free, self-hosted | Teams that already run Prometheus and Alertmanager; it exposes `probe_ssl_earliest_cert_expiry` for alert rules |

Let's Encrypt itself pointed users to Red Sift Certificates Lite when it ended its reminder emails. If you only need expiry emails for many certificates, that is a reasonable choice. ssl.sh focuses on fast setup, Chinese and international chat channels (WeCom, Feishu, DingTalk, Telegram, Slack), outage detection and CT alerts.


## Pricing

| | Free | Pro | Team |
|---|---|---|---|
| Price | $0/mo | $6/mo · $60/yr | $29/mo |
| Domains | 50 | 500 | 3,000 |
| Check interval | every 24 hours | hourly | every 15 minutes |
| Alert channels | Email, Telegram | All 7 | All 7 |
| Custom expiry thresholds | ✓ | ✓ | ✓ |
| Outage and recovery alerts | ✓ | ✓ | ✓ |
| Certificate change alerts | ✓ | ✓ | ✓ |
| CT new-certificate alerts | — | ✓ | ✓ |
| Public status page | — | ✓ | ✓ |
| API | — | 10,000/day | 10,000/day |
| Members | 1 | 1 | 10 |
| Weekly digest email | ✓ | ✓ | ✓ |