Getting started
What is SSLMonitor?
SSLMonitor is a free Bash script, ssl_monitor.sh, that checks when the TLS certificates of your domains expire and emails you a report when one is close to expiry or cannot be read. You run it on your own server from cron. The Forward Email team publishes it on GitHub.
Is SSLMonitor free?
Yes. The script costs nothing and has no account, license key or usage limit. Sending alerts through the Forward Email API needs a paid Forward Email plan, but you can send them through your own sendmail instead at no cost.
Do I need a Forward Email account?
Only for the default delivery method. The API method needs a Forward Email account on a paid plan, an API token and a sender alias on your domain. The sendmail method works with any mail transfer agent on your server, such as Postfix, Exim or msmtp. See email alerts for both.
How often should SSLMonitor run?
Once a day is enough. With the default 30-day warning you get about 30 reports before a certificate expires, and running more often only sends more copies of the same report. The install guide has a daily cron line.
What SSLMonitor checks
Which certificates can it check?
Any certificate served on port 443 by a host your server can reach, including internal hosts that are not on the public internet. It reads the expiry date even from self-signed certificates and certificates from a private certificate authority, because it does not stop on verification errors.
Does it check the certificate chain, hostname or revocation?
No. SSLMonitor only reads the expiry date of the certificate the server sends. It does not report an incomplete chain, a certificate for the wrong name, a revoked certificate or weak TLS settings. Use a scanner such as SSLyze or ssl-checker for those checks.
Can it check ports other than 443?
Not without editing the script. check_certificate connects to "$domain":443. To check another port, change 443 in that line. To check mail servers that use STARTTLS, see the -starttls examples in the command line guide.
Does SSLMonitor renew certificates?
No. It only warns you. Renewal is the job of your ACME client, such as Certbot or cert-manager, or your certificate provider. The alert email reminds you to run certbot renew for Let's Encrypt certificates.
Running the script
Why did my first report include example.com?
If /etc/ssl_monitor/domains.txt does not exist, the script creates it with example.com and mail.example.com as samples and checks them in the same run. Edit the file and replace them with your own domains.
Why do I get the same warning every day?
The script has no memory between runs. Each daily run with a domain in WARNING, CRITICAL or ERROR sends a new report. The reports stop once the certificate is renewed and served. If you get a warning right after every routine renewal, lower WARNING_DAYS as described in certificate lifetimes.
Does it work on macOS?
Not as written. The script uses date -d from GNU coreutils, which the BSD date on macOS does not support, and it writes to /etc and /var/log by default. It is written for Linux servers.
Where are the results stored?
Every run appends one line per domain to /var/log/ssl_monitor.log, plus a line that says whether an alert was sent. The script never trims this file, so add a logrotate rule as shown in the install guide.
Data, certificates and support
What data does the script send, and where?
It connects to each domain in your list on port 443 to read its certificate. When an alert is due, it sends the report (run date, server hostname and the domain table) to the Forward Email API or to your local sendmail. It sends nothing else and has no telemetry.
How long are certificates valid now?
Publicly trusted TLS certificates issued on or after March 15, 2026 can be valid for at most 200 days, falling to 100 days in 2027 and 47 days in 2029. Certificate lifetimes has the full schedule and sources.
Does Let's Encrypt still send expiry reminder emails?
No. Let's Encrypt ended its expiration notification emails on June 4, 2025. A script like SSLMonitor, or another monitoring service, fills that gap.
How do I report a bug or suggest a change?
Open an issue or pull request in the GitHub repository. To report a security problem privately, email security@forwardemail.net as described in the Forward Email security policy.