Get a WhatsApp alert before an SSL certificate expires
An expired certificate is the most avoidable outage there is. The expiry date is known months ahead, published in the certificate itself, and readable by anyone. It still happens constantly.
It happens because auto-renewal fails quietly. Certbot's cron gets removed in a server migration, a DNS challenge stops resolving, the renewal hook errors. Nothing announces it — until every visitor sees a full-page security warning.
Check an expiry date yourself from the terminal
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
| openssl x509 -noout -enddate
# notAfter=Nov 14 08:22:19 2026 GMTSetting it up
- Add an HTTPS monitor for the domain. Certificate checks come with it — there is nothing else to configure.
- Warnings arrive at 14, 7, 3 and 1 days before expiry.
- Add a second recipient. Certificates tend to expire while one person is on holiday.
- Check a domain right now with the free SSL checker, no account needed.
Renewal running is not renewal working
The common failure is a renewal that runs, fails its challenge, logs an error nobody reads, and exits zero. Monitoring the certificate the world actually sees over the network is the only check that cannot be fooled by this, because it reads what the server is serving rather than what a script believes it did.
Check every hostname, not just the apex
A certificate covering example.com may not cover www.example.com, and a wildcard does not cover the apex. Each hostname visitors can reach deserves its own monitor — they expire independently and fail independently.
Domain expiry is the other one
A lapsed domain registration takes everything down at once: site, email, everything, and recovery can mean paying a redemption fee. Domain expiry is checked via RDAP alongside the certificate, with warnings at 30, 14 and 7 days, because that recovery window is much less forgiving.