# SSLMonitor frequently asked questions > Short answers about what ssl_monitor.sh does, what it needs and where its limits are. Source: https://sslmonitor.com/faq/ ## Getting started ### What is SSLMonitor? SSLMonitor is a free Bash script, `ssl_monitor.sh`, that checks when the TLS certificates of your domains expire and emails you a report when one is close to expiry or cannot be read. You run it on your own server from cron. The Forward Email team publishes it on [GitHub](https://github.com/forwardemail/sslmonitor.com). ### Is SSLMonitor free? Yes. The script costs nothing and has no account, license key or usage limit. Sending alerts through the Forward Email API needs a paid Forward Email plan, but you can send them through your own `sendmail` instead at no cost. ### Do I need a Forward Email account? Only for the default delivery method. The API method needs a Forward Email account on a paid plan, an API token and a sender alias on your domain. The `sendmail` method works with any mail transfer agent on your server, such as Postfix, Exim or msmtp. See [email alerts](/ssl-certificate-expiry-alerts/) for both. ### How often should SSLMonitor run? Once a day is enough. With the default 30-day warning you get about 30 reports before a certificate expires, and running more often only sends more copies of the same report. The [install guide](/install/#6-schedule-it-with-cron) has a daily cron line. ## What SSLMonitor checks ### Which certificates can it check? Any certificate served on port 443 by a host your server can reach, including internal hosts that are not on the public internet. It reads the expiry date even from self-signed certificates and certificates from a private certificate authority, because it does not stop on verification errors. ### Does it check the certificate chain, hostname or revocation? No. SSLMonitor only reads the expiry date of the certificate the server sends. It does not report an incomplete chain, a certificate for the wrong name, a revoked certificate or weak TLS settings. Use a scanner such as [SSLyze](https://github.com/nabla-c0d3/sslyze) or [ssl-checker](https://github.com/narbehaj/ssl-checker) for those checks. ### Can it check ports other than 443? Not without editing the script. `check_certificate` connects to `"$domain":443`. To check another port, change `443` in that line. To check mail servers that use STARTTLS, see the `-starttls` examples in the [command line guide](/check-ssl-certificate-expiry-command-line/#check-mail-servers-with-starttls). ### Does SSLMonitor renew certificates? No. It only warns you. Renewal is the job of your ACME client, such as [Certbot](https://github.com/certbot/certbot) or [cert-manager](https://github.com/cert-manager/cert-manager), or your certificate provider. The alert email reminds you to run `certbot renew` for Let's Encrypt certificates. ## Running the script ### Why did my first report include example.com? If `/etc/ssl_monitor/domains.txt` does not exist, the script creates it with `example.com` and `mail.example.com` as samples and checks them in the same run. Edit the file and replace them with your own domains. ### Why do I get the same warning every day? The script has no memory between runs. Each daily run with a domain in `WARNING`, `CRITICAL` or `ERROR` sends a new report. The reports stop once the certificate is renewed and served. If you get a warning right after every routine renewal, lower `WARNING_DAYS` as described in [certificate lifetimes](/certificate-lifetimes/#what-thresholds-should-you-use). ### Does it work on macOS? Not as written. The script uses `date -d` from GNU coreutils, which the BSD `date` on macOS does not support, and it writes to `/etc` and `/var/log` by default. It is written for Linux servers. ### Where are the results stored? Every run appends one line per domain to `/var/log/ssl_monitor.log`, plus a line that says whether an alert was sent. The script never trims this file, so add a logrotate rule as shown in the [install guide](/install/#7-rotate-the-log). ## Data, certificates and support ### What data does the script send, and where? It connects to each domain in your list on port 443 to read its certificate. When an alert is due, it sends the report (run date, server hostname and the domain table) to the Forward Email API or to your local `sendmail`. It sends nothing else and has no telemetry. ### How long are certificates valid now? Publicly trusted TLS certificates issued on or after March 15, 2026 can be valid for at most 200 days, falling to 100 days in 2027 and 47 days in 2029. [Certificate lifetimes](/certificate-lifetimes/) has the full schedule and sources. ### Does Let's Encrypt still send expiry reminder emails? No. Let's Encrypt [ended its expiration notification emails on June 4, 2025](https://letsencrypt.org/2025/06/26/expiration-notification-service-has-ended). A script like SSLMonitor, or another monitoring service, fills that gap. ### How do I report a bug or suggest a change? Open an issue or pull request in the [GitHub repository](https://github.com/forwardemail/sslmonitor.com). To report a security problem privately, email security@forwardemail.net as described in the Forward Email [security policy](https://forwardemail.net/en/security).