Get alerted before an SSL/TLS certificate expires

With automatic renewal (Let's Encrypt, ACME, cloud-managed certificates), certificate expiry should be a solved problem. In practice, renewals still break: a DNS challenge stops working after a DNS provider change, port 80 gets closed by a firewall change, the renewal cron job disappears, or a load balancer keeps serving an old certificate after the new one was issued. As certificate lifetimes shrink toward 47 days, renewals happen more often, which means more chances for them to break.

What to check

• Days until expiry of the certificate actually served, not just the one on disk.
• Chain validity: a missing intermediate certificate breaks some clients while browsers keep working.
• Hostname match, so you know the certificate covers the name people actually use.

A one-liner to check it yourself

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate

Automating it

CronPup's TLS monitors connect to your host every 6 hours, validate the chain and hostname the way a browser does, and alert you when the certificate is within your warning window (14 days by default) or doesn't validate. They sit in the same dashboard and alert channels as your cron job monitors.

Add your domains. TLS monitors count toward the same plan limit, and 10 are free.