# SSL certificate expiry monitoring with email alerts

> SSLMonitor is a free Bash script from the Forward Email team. Run it daily from cron and it emails you a report when a certificate on any of your domains is close to expiry or cannot be read.

Source: https://sslmonitor.com/

## What does SSLMonitor do?

SSLMonitor is one Bash script, `ssl_monitor.sh`. Each time it runs, it reads a list of domains, connects to each one on port 443, reads the expiry date of the certificate the server sends, and emails you one report if any certificate is close to expiry or could not be read.

1. It reads domains from `/etc/ssl_monitor/domains.txt`, one per line. Lines that start with `#` and empty lines are skipped.
2. For each domain it runs `openssl s_client` with SNI set to that domain and reads the `notAfter` date with `openssl x509`.
3. It works out the whole days left and marks the domain `OK`, `WARNING` (fewer than 30 days), `CRITICAL` (fewer than 7 days) or `ERROR` (no certificate could be read).
4. It appends every result to `/var/log/ssl_monitor.log`.
5. If any domain is `WARNING`, `CRITICAL` or `ERROR`, it sends one HTML email with a table of all domains. If every domain is `OK`, it sends nothing.

The email goes out through the [Forward Email API](https://forwardemail.net/en/email-api) by default, or through your server's local `sendmail` if you switch one line. Run it once a day from cron and you get a warning weeks before a certificate expires.

## Why monitor certificate expiry?

An expired certificate makes browsers show a full-page warning and makes most API clients and mail servers refuse the connection. Automated renewal fails for ordinary reasons: a DNS change, a firewall rule, a full disk or a client that was never set up on a new server. A separate check that only looks at what your servers actually serve catches those failures before your visitors do.

Certificate lifetimes are getting shorter, so renewals happen more often and there are more chances for one to fail:

- Under the [CA/Browser Forum Baseline Requirements](https://github.com/cabforum/servercert/blob/main/docs/BR.md) (ballot SC-081), publicly trusted TLS certificates issued on or after March 15, 2026 may be valid for at most 200 days. The limit drops to 100 days on March 15, 2027 and to 47 days on March 15, 2029.
- Let's Encrypt [stopped sending expiration reminder emails](https://letsencrypt.org/2025/06/26/expiration-notification-service-has-ended) on June 4, 2025.
- Let's Encrypt [plans to move from 90-day to 45-day certificates](https://letsencrypt.org/2025/12/02/from-90-to-45), with 45 days becoming the default on February 16, 2028.

Read [certificate lifetimes](/certificate-lifetimes/) for the full schedule and what it means for your alert thresholds.

## Quick start

Download the script, set your email settings, list your domains and add a cron entry. The [install guide](/install/) explains each step.

```bash
sudo curl -fsSL -o /usr/local/bin/ssl_monitor.sh \
  https://raw.githubusercontent.com/forwardemail/sslmonitor.com/main/ssl_monitor.sh
sudo chmod +x /usr/local/bin/ssl_monitor.sh
sudo nano /usr/local/bin/ssl_monitor.sh        # set EMAIL_TO, EMAIL_FROM, FORWARD_EMAIL_API_KEY
sudo mkdir -p /etc/ssl_monitor
echo "example.com" | sudo tee /etc/ssl_monitor/domains.txt
sudo /usr/local/bin/ssl_monitor.sh && sudo tail /var/log/ssl_monitor.log
```

Then add this line with `sudo crontab -e` to run the check every day at 08:00:

```text
0 8 * * * /usr/local/bin/ssl_monitor.sh
```

## Requirements and limits

The script needs Bash, OpenSSL, GNU `date` (standard on Linux, not the BSD `date` on macOS) and either `curl` with a Forward Email API key or a working `sendmail` command. By default it writes to `/etc/ssl_monitor` and `/var/log`, so run it as root or change those paths.

It checks port 443 only and reports expiry dates only. It does not check the certificate chain, hostname match, revocation or TLS settings, and it does not renew certificates. The [FAQ](/faq/) covers these limits and how to work around them.

## Built by the Forward Email team

SSLMonitor is a free script from the team behind [Forward Email](https://forwardemail.net), an open source email service. The source is on [GitHub](https://github.com/forwardemail/sslmonitor.com). Read [about this site](/about/) for contact details and the privacy note.