Free SSL expiry monitoring

Let’s Encrypt no longer sends expiry emails. Here is a free replacement.

On 4 June 2025 Let’s Encrypt stopped sending certificate expiration emails. Renewal is supposed to be automatic, but when it silently fails, nobody warns you anymore. TLDix checks the certificate your site actually serves and emails you before it expires. Source

Start free monitoring Free plan: 20 domains, no card.

Why automatic renewal still fails

A DNS change or new CDN stops the HTTP-01 or DNS-01 challenge from validating.
A firewall rule, redirect or web server change blocks /.well-known/acme-challenge/.
The cron job or systemd timer that runs certbot was removed during a server migration.
The renewal worked, but the web server was never reloaded, so the old certificate is still served.
An API token used for DNS validation expired, or a rate limit was hit after repeated failures.

In every case the certificate keeps counting down quietly. Let’s Encrypt’s emails used to be the last safety net; since June 2025 that net is gone.

What TLDix checks for you

The certificate your visitors really getWe connect to your site over HTTPS from outside, so we see the certificate actually served, including after a forgotten reload or a CDN change.

Alerts before expiryEmails at 14, 7, 3 and 1 day before expiry and on the day itself. Checks run every 12 hours, and every 4 hours in the final week or after a failed check.

Renewals that are lateFor certificates of up to 200 days, we warn you when a certificate has not been renewed by the usual renewal point (one third of its lifetime, at most 30 days before expiry), long before it actually expires.

Connection and handshake failuresIf HTTPS stops working, you get an alert with the exact error, and another one when it recovers.

Domain renewals tooThe same watchlist tracks your domain registration expiry dates, so an expired domain does not take your site down either.

Set it up in two minutes

Create a free account with your email address.
Add your domains. No agent, plugin or DNS change is needed.
Get alerts by email. On Pro and above they can also go to Slack or your own webhook.

Start free monitoring

Let’s Encrypt emails vs TLDix

	Let’s Encrypt emails (until June 2025)	TLDix free plan
Warning before expiry	Yes	Yes, 14/7/3/1 days
Based on the certificate your server actually serves	No, based on issued certificates	Yes
Warns when a renewal is late	No	Yes
Works for any certificate authority	Let’s Encrypt only	Yes
Domain registration expiry	No	Yes
Price	Free (discontinued)	Free, up to 20 domains

Other ways to stay safe

Keep automatic renewal: certbot, acme.sh, your host’s AutoSSL or your CDN. Add a deploy hook so the web server reloads after renewal. Then add an outside check like TLDix, because a renewal client cannot warn you about failures it does not know about. Certificate lifetimes are shrinking to 200 days in 2026, 100 days in 2027 and 47 days in 2029, so renewals will run more often and each one is another chance to fail.

Read our scan of the top 10,000 sites: The 200-Day Cliff → · SSL Checker →

Frequently asked questions

Does Let’s Encrypt still send expiration emails?

No. Let’s Encrypt ended its expiration notification emails on 4 June 2025 and recommends monitoring your certificates with a separate service.

Is TLDix really free?

Yes. The free plan monitors up to 20 domains with email alerts and needs no credit card. Paid plans add more domains, Slack alerts and webhooks.

Do I need to install anything on my server?

No. TLDix checks your site from outside over HTTPS, the same way a visitor’s browser does.

How often are certificates checked?

Every 12 hours, and every 4 hours when a certificate has less than a week left or the last check failed.

Does it work with short-lived certificates?

Yes. For certificates of 30 days or less, expiry alerts only start once less than a quarter of the lifetime is left, so normal renewal cycles do not cause noise.