# SSLMonitor

> SSLMonitor (ssl_monitor.sh) is a free Bash script from the Forward Email team. Run daily from cron, it reads the expiry date of the TLS certificate served on port 443 for each domain in /etc/ssl_monitor/domains.txt, logs the result, and emails one HTML report through the Forward Email API or local sendmail when any certificate has fewer than 30 days left (WARNING), fewer than 7 days left (CRITICAL), or cannot be read (ERROR).

The script needs Bash, OpenSSL, GNU date and curl or sendmail. It checks expiry dates only: not chains, hostnames, revocation or other ports. Sending through the Forward Email API needs a paid Forward Email plan.

## Pages

- [Home](https://sslmonitor.com/index.md): What the script does, why expiry monitoring matters, quick start, requirements and limits.
- [Install guide](https://sslmonitor.com/install.md): Requirements, configuration variables, domains file, delivery method, testing, cron, log rotation, troubleshooting and the full script.
- [Email alerts](https://sslmonitor.com/ssl-certificate-expiry-alerts.md): Alert states and thresholds, the report email, Forward Email API and sendmail delivery, multiple recipients.
- [Command line checks](https://sslmonitor.com/check-ssl-certificate-expiry-command-line.md): openssl s_client and x509 examples: expiry date, ISO dates, -checkend, days left, SAN names, files on disk, STARTTLS, curl.
- [Certificate lifetimes](https://sslmonitor.com/certificate-lifetimes.md): CA/Browser Forum SC-081 validity and validation reuse schedule, Let's Encrypt 45-day plan, suggested alert thresholds.
- [FAQ](https://sslmonitor.com/faq.md): Common questions about cost, accounts, scope, limits, data sent and certificate rules.
- [About](https://sslmonitor.com/about.md): Publisher, source code, contact, privacy note.

## Source

- [ssl_monitor.sh](https://raw.githubusercontent.com/forwardemail/sslmonitor.com/main/ssl_monitor.sh): the script itself
- [GitHub repository](https://github.com/forwardemail/sslmonitor.com): source for the script and this site

## Optional

- [Full text of every page](https://sslmonitor.com/llms-full.txt): all pages above in one Markdown file
- [Forward Email Email API](https://forwardemail.net/en/email-api): the API the script uses to send alerts
- [CA/Browser Forum Baseline Requirements](https://github.com/cabforum/servercert/blob/main/docs/BR.md): source of the certificate validity limits