An expired SSL certificate does not take your server down, but it might as well. Browsers show a full-page security warning, most visitors leave, checkout and login forms stop working, and API clients refuse to connect. It usually happens because an automatic renewal broke months ago and nobody noticed. SSL expiry monitoring gives you a warning days or weeks ahead, while fixing it is still a five-minute job. This guide shows how to set it up for free.
Why SSL certificates still expire by surprise
Most certificates renew automatically today, so expiry feels like a solved problem. In practice, automatic renewal fails quietly for many ordinary reasons:
- The renewal job stopped running. A server move, a new container image or a lost scheduled task means the renewal command never runs again.
- Validation fails. A DNS change, a new CDN or proxy, or a firewall rule blocks the check your certificate authority uses to confirm you own the domain.
- The new certificate was never loaded. The file renewed on disk, but the web server was not reloaded, so it keeps serving the old one.
- A forgotten subdomain. The main site renews fine, while the shop, the mail server or an old landing page uses a certificate that was set up by hand.
- Reminder emails stopped. Let's Encrypt, for example, ended its expiry reminder emails in 2025, so many site owners lost a warning they used to rely on.
Certificate lifetimes are also getting shorter. The industry rules that browsers follow are cutting the maximum validity of public certificates step by step, so renewals happen more often and every broken renewal reaches the expiry date sooner.
What SSL expiry monitoring checks
An SSL expiry monitor connects to your domain from the outside, exactly like a browser, reads the certificate your server actually serves, and compares its expiry date with today. That last part matters: it checks the certificate visitors see, not the file on your server, so it also catches a renewal that was never loaded.
On My Site Alerts, SSL and domain checks live together in one domain name monitor:
| Check | What it watches | Why it matters |
|---|---|---|
| SSL certificate expiry | The expiry date of the certificate served on your domain | Prevents browser security warnings and failed connections |
| Domain name expiry | The registration expiry date from the public domain records | Prevents losing the domain itself, along with your website and email |
| Registrar and nameservers | Who your domain is registered with and where its DNS points | Helps you spot unexpected changes |
The free plan includes 5 domain name monitors, enough for your main site and the subdomains or client sites that matter most.
How to set up free SSL expiry alerts
1. Create a free account
Sign up for My Site Alerts with your email address. There is no credit card and no trial period.
2. Add a domain name monitor
Open Domain names in your dashboard and choose Create domain name. Enter the domain, such as example.com, and give it a clear name. Add a separate monitor for every subdomain that has its own certificate, such as shop.example.com.
3. Choose when to be notified
Under SSL expiration notifications, pick how far ahead you want the warning: from 1 day up to 2 months before expiry. For certificates that renew automatically, 7 or 14 days is a good choice: enough time to fix a failed renewal, and late enough that a healthy renewal has already happened, so you are not warned about something that fixes itself.
4. Turn on domain expiry alerts too
Under Domain name expiration notifications, choose a longer lead time, such as 1 or 2 months. Domain renewals often depend on a payment card or a registrar account that someone has to update by hand.
5. Choose where alerts go
Email works out of the box. You can also send alerts to Slack, Discord, Telegram, Microsoft Teams or your own webhook, so the warning reaches the people who can actually renew the certificate.
Check a certificate right now
Want to know where you stand today? Run any domain through the free SSL checker to see the issuer and the expiry date. If you prefer the command line, this shows the dates of the certificate a server is serving:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -datesThe notAfter line is the expiry date. A one-off check is useful, but it only helps on the day you run it. Monitoring repeats the check for you and only speaks up when something needs attention.
What to do when you get an expiry alert
- Check whether it renewed. Run the SSL checker again. If the expiry date moved forward, the alert was early and you are done.
- Look at the renewal logs. Your hosting panel, your certificate tool or your CDN dashboard will usually show why the last renewal failed.
- Fix validation. Make sure the domain still points to the server or proxy that requests the certificate, and that the validation path is not blocked.
- Reload the web server. If a new certificate exists on disk but visitors still see the old one, reload or restart the web server.
- Renew by hand if time is short. Renew manually now and fix the automation afterwards, so visitors never see a warning.
Pre-expiry checklist
- Every domain and subdomain with its own certificate has a monitor.
- Domain registrations are set to auto-renew, with a payment card that is still valid.
- Alerts go to a shared channel, not only to one person who might be on holiday.
- The renewal job itself is watched with a heartbeat, so a broken schedule is caught long before the expiry date.
SSL monitoring works best next to uptime checks
SSL expiry alerts warn you about a problem that is coming; uptime checks tell you the moment visitors cannot reach your site. Together they cover both. Follow our guides on how to monitor website uptime for free and how to monitor cron jobs for free to watch the renewal job as well.
It takes about two minutes per domain. Create your free account, add your main domain, and let us keep watch so you do not have to.
Frequently asked questions
How do I know when my SSL certificate expires?
Open the padlock in your browser and view the certificate details, run your domain through a free SSL checker, or set up an SSL expiry monitor that checks the date for you and sends an alert before it runs out.
What happens when an SSL certificate expires?
Browsers show a security warning instead of your site, most visitors leave, and forms, checkouts and API connections that require a valid certificate stop working until it is renewed.
Is SSL expiry monitoring really free?
Yes. The free plan includes 5 domain name monitors that track both SSL certificate and domain expiry, with email, Slack, Discord, Telegram, Microsoft Teams and webhook alerts. There is no credit card and no trial that runs out.
Do I still need monitoring if my certificate renews automatically?
Yes. Automatic renewal fails quietly when a scheduled task stops, validation is blocked or the server is not reloaded. Monitoring checks the certificate visitors actually see, so it catches all of these.
How many days before expiry should I get an alert?
For certificates that renew automatically, 7 to 14 days works well. For certificates you renew by hand, and for domain names, choose 1 or 2 months so there is time to handle payment and approvals.