SSL certificate expiry monitoring with email alerts

What does SSLMonitor do?

SSLMonitor is one Bash script, ssl_monitor.sh. Each time it runs, it reads a list of domains, connects to each one on port 443, reads the expiry date of the certificate the server sends, and emails you one report if any certificate is close to expiry or could not be read.

1. It reads domains from /etc/ssl_monitor/domains.txt, one per line. Lines that start with # and empty lines are skipped.
2. For each domain it runs openssl s_client with SNI set to that domain and reads the notAfter date with openssl x509.
3. It works out the whole days left and marks the domain OK, WARNING (fewer than 30 days), CRITICAL (fewer than 7 days) or ERROR (no certificate could be read).
4. It appends every result to /var/log/ssl_monitor.log.
5. If any domain is WARNING, CRITICAL or ERROR, it sends one HTML email with a table of all domains. If every domain is OK, it sends nothing.

The email goes out through the Forward Email API by default, or through your server's local sendmail if you switch one line. Run it once a day from cron and you get a warning weeks before a certificate expires.

Why monitor certificate expiry?

An expired certificate makes browsers show a full-page warning and makes most API clients and mail servers refuse the connection. Automated renewal fails for ordinary reasons: a DNS change, a firewall rule, a full disk or a client that was never set up on a new server. A separate check that only looks at what your servers actually serve catches those failures before your visitors do.

Certificate lifetimes are getting shorter, so renewals happen more often and there are more chances for one to fail:

• Under the CA/Browser Forum Baseline Requirements (ballot SC-081), publicly trusted TLS certificates issued on or after March 15, 2026 may be valid for at most 200 days. The limit drops to 100 days on March 15, 2027 and to 47 days on March 15, 2029.
• Let's Encrypt stopped sending expiration reminder emails on June 4, 2025.
• Let's Encrypt plans to move from 90-day to 45-day certificates, with 45 days becoming the default on February 16, 2028.

Read certificate lifetimes for the full schedule and what it means for your alert thresholds.

Quick start

Download the script, set your email settings, list your domains and add a cron entry. The install guide explains each step.

sudo curl -fsSL -o /usr/local/bin/ssl_monitor.sh \
  https://raw.githubusercontent.com/forwardemail/sslmonitor.com/main/ssl_monitor.sh
sudo chmod +x /usr/local/bin/ssl_monitor.sh
sudo nano /usr/local/bin/ssl_monitor.sh        # set EMAIL_TO, EMAIL_FROM, FORWARD_EMAIL_API_KEY
sudo mkdir -p /etc/ssl_monitor
echo "example.com" | sudo tee /etc/ssl_monitor/domains.txt
sudo /usr/local/bin/ssl_monitor.sh && sudo tail /var/log/ssl_monitor.log

Then add this line with sudo crontab -e to run the check every day at 08:00:

0 8 * * * /usr/local/bin/ssl_monitor.sh

Requirements and limits

The script needs Bash, OpenSSL, GNU date (standard on Linux, not the BSD date on macOS) and either curl with a Forward Email API key or a working sendmail command. By default it writes to /etc/ssl_monitor and /var/log, so run it as root or change those paths.

It checks port 443 only and reports expiry dates only. It does not check the certificate chain, hostname match, revocation or TLS settings, and it does not renew certificates. The FAQ covers these limits and how to work around them.

Built by the Forward Email team

SSLMonitor is a free script from the team behind Forward Email, an open source email service. The source is on GitHub. Read about this site for contact details and the privacy note.