The live certificate
We dial your server with the right name and read the certificate it presents. You see the issuer, names covered, serial, fingerprint, and whether the chain is trusted.
Reads the live certificate, not just the registrar record
Know when your certificates and domains expire, before your customers do.
Monitor SSL certificates and domain registrations in one place. We alert you at 30, 14, 7 and 1 days, and right away if a site goes down or loses trust.
No signup. Results in a few seconds.
What shop.example.com is presenting
CN=shop.example.com
Checked Nov 14, 2026 11:01 UTC · 104.21.32.10
Certificate expires
Dec 7, 2026
in 23 days
Chain of trust
Trusted
TLSv1.3
Domain registration
Jul 14, 2027
in 242 days ยท Cloudflare, Inc.
Issued Sep 8, 2026
Expires Dec 7, 2026
- Issued to
- CN=shop.example.com
- Issued by
- C=US, O=Let's Encrypt, CN=E7
- Names covered
- shop.example.com www.shop.example.com
- Serial number
- 04A3F9C1B7E2D85A
- Protocol
- TLSv1.3
- SHA-256 fingerprint
- A1:4C:9E:2B:77:D0:3F:91:58:6A:CE:0B:24:9D:F1:60:7E:3C:B8:52:9A:D4:01:6F:AE:C7:33:8B:5E:19:D2:A6
- Check frequency
- Hourly
- on paid plans
- Alert thresholds
- 30 / 14 / 7 / 1
- days before expiry
- Registrar data
- RDAP
- no WHOIS scraping
- Alert noise
- Once
- per threshold, per renewal
What it does
Built for the moment a renewal slips
Most expiry tools read a date from a record somewhere. We connect to your server and read what it actually serves, so you see the problem the same way your visitors do.
Registrar expiry
Domain registration dates come from RDAP, the modern registry protocol. We never scrape WHOIS or price pages, and we tell you when a TLD does not publish the date.
Alerts that stay quiet
Each threshold fires once per certificate or registration cycle. When you renew, the cycle resets. No daily reminder spam, and you hear about real problems: expiry, unreachable, or untrusted.
How it works
Set it once. Then forget it, until it matters.
-
01
Add your domains
Paste a hostname. We resolve it, confirm it is public, and run the first check straight away.
-
02
We check on schedule
Free plans check daily. Paid plans check hourly. Each run stores a snapshot you can review later.
-
03
You get the one email that matters
An alert at each threshold, a note if the site drops or loses trust, and a recovery message when it is fixed.
Pricing
Start free. Upgrade when your list grows.
Annual billing saves two months on every paid plan.
Free
$0 / month
- 3 monitored domains
- Daily checks
- Email alerts
- Public checker, unlimited
Starter
$9 / month
- 25 monitored domains
- Hourly checks
- Email alerts
- Slack and Discord alerts
- Priority support by email
Pro
$19 / month
- 100 monitored domains
- Hourly checks
- Email alerts
- Slack and Discord alerts
- Priority support by email
FAQ
Questions we hear a lot
Why is the certificate date different from my registrar date?
They measure different things. The certificate date is how long the TLS certificate is valid. The registrar date is when your domain registration ends. We show both, and each has its own alert.
Does this work with Let's Encrypt and other short-lived certificates?
Yes. We read the certificate the server presents at check time, not a copy stored elsewhere. Short-lived certificates renew often, so the alert keys on the certificate fingerprint and each renewal starts a fresh cycle.
Why did I get a "not trusted" alert?
The certificate chain did not verify against our trust store, or the certificate does not cover the name we checked. The alert shows the reason. A server missing its intermediate certificate is the most common cause.
Can you check internal or private servers?
No. We only check public addresses. A hostname that resolves to a private or reserved IP is refused, which protects your network and ours.
How do you read registrar dates?
We use RDAP, the registry protocol that replaced WHOIS for most TLDs. Some TLDs do not publish an expiry date over RDAP. In that case we say so rather than guess.