When does SSLMonitor send an alert?
SSLMonitor sends one email per run when at least one domain is not OK. It sends nothing when every certificate has more days left than WARNING_DAYS. Each domain gets one of four states:
| State | Rule (default values) | Row color in the email |
|---|---|---|
OK | 30 or more whole days left | White |
WARNING | Fewer than WARNING_DAYS (30) days left | Light yellow |
CRITICAL | Fewer than CRITICAL_DAYS (7) days left, or already expired | Light red |
ERROR | No certificate could be read (DNS failure, port 443 closed, no TLS) | Light red |
Days left are whole days, rounded down: a certificate that expires in 9 days and 20 hours shows 9. An expired certificate shows a negative number and counts as CRITICAL.
Because cron runs the script every day, a domain that stays in WARNING sends a report every day until the certificate is renewed. There is no separate "all clear" email: the reports stop once every domain is OK again.
What is in the alert email?
The subject line is SSL Certificate Alert: <server hostname> - <YYYY-MM-DD>. The body is an HTML report with the run date, the server hostname and a table of every domain in your list, including the ones that are OK. With the API method the script also sends a plain text copy of the same report.
A report for three domains looks like this (sample data):
| Domain | Expiry Date | Days Left | Status |
|---|---|---|---|
| example.com | Jan 14 23:59:59 2027 GMT | 87 | OK |
| api.example.com | Nov 12 08:30:00 2026 GMT | 24 | WARNING |
| old.example.net | 0 | ERROR |
Below the table the email reminds you to renew at least 14 days before expiry and gives two renewal hints: run certbot renew for Let's Encrypt certificates, or contact your certificate provider for others.
How are alerts sent?
The script has two delivery functions. Only one is active at a time; the Forward Email API is the default.
Forward Email API (default)
send_email_api posts the report to https://api.forwardemail.net/v1/emails with curl. It authenticates with HTTP Basic auth, using your API token as the username and an empty password, which is the method the Email API docs describe. Every field is form-encoded, so the multi-line HTML report arrives intact.
What you need:
- A Forward Email account on a paid plan. The Forward Email FAQ states that outbound SMTP comes with all paid plans.
- A domain in that account with DKIM, Return-Path and DMARC set up, and an alias on it to use as
EMAIL_FROM. - Your API token from the Security page of your account, set as
FORWARD_EMAIL_API_KEY.
The script logs Alert email sent via API when the API accepts the message and Failed to send alert email via API when it rejects it or cannot be reached.
Local sendmail
send_email_smtp pipes the report, with Subject, From, To and Content-Type: text/html headers, to sendmail -t. It works with any mail transfer agent that provides a sendmail command, such as Postfix, Exim or msmtp. To deliver through Forward Email, configure that agent to relay through smtp.forwardemail.net on port 465 (SSL/TLS) or 587 (STARTTLS), logging in with the full alias address and its generated password.
This method logs Alert email sent via SMTP after handing the message to sendmail. It does not check whether sendmail succeeded, so check your mail log if a report does not arrive.
Can I send alerts to more than one person?
Yes. Put several addresses in EMAIL_TO, separated by commas: EMAIL_TO="ops@example.com,admin@example.com". The Forward Email API accepts a comma-separated to list, and sendmail -t reads every address in the To: header. You can also point EMAIL_TO at one Forward Email alias that forwards to the whole team.
How do I change when alerts start?
Edit WARNING_DAYS and CRITICAL_DAYS at the top of the script. Set WARNING_DAYS below the number of days left when your ACME client normally renews, so a routine renewal does not send a warning. Certificate lifetimes has suggested values for 90-day, 45-day and longer certificates.
Why not rely on my certificate authority's reminders?
Not every certificate authority sends them, and they only cover certificates that authority issued. Let's Encrypt ended its expiration reminder emails on June 4, 2025 and points its users to third-party monitoring services instead. A reminder from the authority also says nothing about which certificate your server is actually serving. SSLMonitor checks what each server returns, so it also catches a renewed certificate that was never installed or a web server that was never reloaded.