SSL Expiry Notifier

Monitor certificate expiry and receive notifications

Domain

Port

Webhook URL

Days Before Expiry

Results

About

The SSL Certificate Expiry Notifier sends automated notifications before your certificates expire, ensuring you never experience service disruptions from expired certificates. Configure notification channels including email, webhook, and Slack to receive alerts at customizable intervals — 7, 14, 30, 60, or 90 days before expiry.

The notifier integrates with the Certificate Monitor to provide proactive expiry management across your entire infrastructure. Each notification includes the domain name, expiration date, days remaining, and a direct link to initiate renewal. Combined with auto-renewal tools like Let's Encrypt, the notifier forms a critical part of automated certificate lifecycle management.

How to Use

1Configure your notification channels (email, webhook, or Slack)
2Set the notification threshold for each domain (how many days before expiry to notify)
3The system automatically checks certificate expiry daily and sends notifications when thresholds are reached
4Receive notifications with domain details and renewal instructions

Use Cases

•Automated Expiry Prevention: Eliminate manual certificate tracking by automating expiry notifications across all domains
•Multi-Channel Alerts: Send notifications via email for routine checks, Slack for team visibility, and webhook for integration with ticketing systems
•Enterprise Certificate Management: Coordinate renewal across hundreds of domains with centralized notification management
•Compliance Automation: Meet PCI DSS and SOC 2 requirements for certificate lifecycle management with documented notification logs
•Vendor Coordination: Notify external teams when certificates managed by third-party vendors approach expiry

Tips & Best Practices

•Configure multiple notification channels for redundancy — email can fail, webhooks can timeout
•Set 60-day notifications for production systems to allow time for change management processes
•Use webhook notifications to create automated tickets in your incident management system
•Test notification channels regularly to ensure they are working correctly

Technical Details

●Notification Channels: Email (SMTP), Webhook (HTTP POST), Slack (Incoming Webhooks)

●Scheduling: Daily checks with configurable notification thresholds (7, 14, 30, 60, 90 days)

●Retry Logic: Failed notifications are retried up to 3 times with exponential backoff

●Rate Limiting: Prevents notification spam with per-domain rate limiting

Frequently Asked Questions

Configure a webhook URL in your notification settings. When a certificate approaches expiry, the system sends a POST request with JSON payload containing domain, expiry date, days remaining, and urgency level. Use this to integrate with PagerDuty, Jira, or custom automation scripts.

Yes, notification templates support custom text, variable substitution (domain, days_remaining, expiry_date), and formatting. Email notifications support HTML templates, while webhooks send structured JSON that you can process in any format your systems require.

The system retries failed notifications up to 3 times with increasing delays (5min, 30min, 2hours). If all retries fail, the notification is logged as failed and can be viewed in the notification history. Critical notifications can be configured to escalate to alternative channels.

Three checkpoints cover nearly everything: 30 days to notice and plan, 14 days to act, and 3 days to treat as an incident. Anything longer than 30 days and you read it once and forget it; anything shorter and there is no room to get a certificate signed. Most CAs issue within minutes, so the alert is not about the CA being slow — it is about your own process quietly failing before renewal day.

Yes, because automation fails quietly. A renewal can stop working when the DNS challenge loses its API token, the cron dies, the hook script starts exiting non-zero, or the certificate is renewed and then never deployed — every one of those leaves a certificate that looks fine on paper and quietly ages. This notifier is the independent check on the pipeline rather than part of it, which is exactly why it is worth running when you believe you already have it covered.

That distinction matters. A notifier reading your stored certificate knows what you think you deployed; only a live check knows what a visitor receives. A CDN in front of your origin, or a renewal that was generated but never uploaded, leaves the stored certificate valid while the live one expires. Run both: the stored certificate drives the renewal workflow, and a live domain check acts as the independent alarm.

Point a webhook at a request catcher such as webhook.site, save it, and trigger a test notification. Confirm three things: the request arrives, it arrives from an address you recognise, and the payload is what you expected. Then test the failure path, because a notifier that has never reported a failure is not evidence that it works — temporarily point it at a bad URL and confirm it records an error and retries rather than going quiet.

The hostname, the expiry date, the days remaining, the issuer, and which threshold triggered the alert — enough to identify the certificate without opening a dashboard. Add the serial number if you run more than one certificate per domain, otherwise an alert about the wrong certificate is indistinguishable from an alert about the right one. Keep the payload to identifiers and dates, and never include key material.