SSL & Domain Expiry Monitor

Check the SSL certificate and domain registration expiry of every domain you manage, and get alerts before anything lapses — days left, issuer, exact expiry dates, ready to pipe into Slack or email.

An expired certificate takes your site down with a full-screen browser warning; an expired domain can take your email and your brand with it. Both failures are 100% predictable — and still happen to companies every day, because the renewal date lives in nobody's calendar. Put it in a schedule instead.

What it does

For each domain you list:

1. Connects to port 443 and reads the live TLS certificate: expiry date, days left, issuer.
2. Looks up the domain registration expiry via RDAP — the registries' official public protocol (successor of WHOIS).
3. Raises an alert when either is within your threshold (default 30 days), is already expired, or the certificate check fails.

Input example

{
  "domains": ["example.com", "https://client-site.fr", "shop.example.io"],
  "warnDays": 30,
  "alertsOnly": true
}

The defaults work as-is.

Output example

{
  "domain": "client-site.fr",
  "certValidTo": "2026-07-16T00:00:00.000Z",
  "certDaysLeft": 10,
  "certIssuer": "Let's Encrypt",
  "domainExpiresAt": "2027-03-01T00:00:00.000Z",
  "domainDaysLeft": 238,
  "hasAlert": true,
  "alerts": ["certificate expires in 10 day(s)"],
  "checkedAt": "2026-07-06T16:00:00.000Z"
}

A SUMMARY record gives the fleet picture: domains checked, alerts, and the single closest expiry across everything you monitor.

How to use it

• Agencies: one run with all client domains, weekly schedule, alertsOnly: true piped to Slack — you'll never again learn about an expired cert from an angry client.
• Your own portfolio: side projects are exactly the domains nobody watches; 2 minutes of setup covers them forever.
• Renewal-day negotiation: domainDaysLeft across a portfolio tells you which renewals to batch this month.

Fair use & data

• Uses only a standard TLS handshake (the same thing every browser does) and RDAP, the registries' official public lookup protocol.
• No personal data collected — registrant contact details are neither requested nor stored.
• Hard cap of 50 domains per run keeps runs bounded and predictable.

FAQ

Domain expiry shows null? Some country-code TLDs don't expose expiration via RDAP. The certificate check always works; null means "registry doesn't publish it", never a guess.

Why does it alert every run? By design — an approaching expiry should nag until fixed. Fix it and the alert stops.

Wildcard/multi-SAN certificates? The check reads whatever certificate the server presents for the domain name you listed, exactly like a visitor's browser would.