Stopped getting SSL expiry emails? How to get warned now

Do you need to do anything?

Those emails were never what kept your site up. If your certificates renew automatically, they carry on renewing without them. What you lost is the accidental safety net: a reminder that arrived about 20 days before expiry when renewal had quietly stopped working.

So you need a replacement only if you'd want to know that renewal broke before your visitors do. For a site that matters, you probably would.

What each way of watching catches

Most advice says "use a monitor" and stops there. They don't all see the same things, and the differences matter.

What went wrong	Reading the certificate your server presents	Reading public certificate logs	Your renewal tool's own logs
Renewal stopped working	Yes	Yes	Only if someone reads them
Renewed, but the server still presents the old certificate	Yes	No, until the old one expires and connections fail	No: it reports success
A certificate you didn't ask for was issued for your name	Only once it's installed	Yes, if the tool compares issuers or certificates	No
A hostname nobody remembered	Only if it's on your list	Only if you search the logs for it	Only on that server

The second row is the one that catches people out. A renewal tool can get a new certificate, and if the web server was never told to reload, it goes on presenting the old one until it expires.

A check you can run today

This asks the server for the certificate it actually presents, and says whether it will expire within 14 days. Replace both copies of the hostname:

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null | openssl x509 -noout -enddate -checkend 1209600

It prints the expiry date, then either Certificate will not expire or Certificate will expire. The second one makes the command exit with a failure code, so a scheduled job can act on it. The 1209600 is 14 days in seconds.

Why 14 days and not 30? Automatic renewal usually starts well before then, so a warning at 30 can fire on perfectly healthy certificates. A warning that goes off every cycle soon gets ignored.

A worked example: the job that stops being safe

Say a scheduled job renews a certificate every 60 days, with no check on how much life is left.

With today's 90-day certificates: it renews with 30 days left. If that run fails, a warning at 14 days gives you two weeks to fix it by hand.
With the 64-day certificates Let's Encrypt plans from February 10, 2027: it renews with only 4 days left. A 14-day warning now fires on every cycle, before the job has even run, so it tells you nothing. If the run fails, the certificate expires 4 days later, and the next run is 56 days after that.

The fix is the same either way: renew by how much life is left, not by the calendar. More on the shorter lifetimes: what changes in 2027.

Your options

A scheduled script using the command above. It's free and reads the presented certificate. You own it, including the failure where the machine running it is the thing that died.
A free monitoring service. Let's Encrypt's list of monitoring options names several, without endorsing them. It says Red Sift Certificates Lite is free for up to 250 certificates, and it's the one Let's Encrypt's own announcement suggests. Before choosing any of them, check which column of the table above it falls in.
Our certificate watch. Part of Domain Health's paid plans, from 10 hostnames at $9 a month, and worth it mainly if you also want your SPF, DKIM and DMARC watched in the same place. It reads public logs and makes a live connection, so it's in the second column: it won't catch a renewed certificate that was never installed until the old one expires and the connection fails. If that's your main worry, use something that reads the presented certificate.

What the check above can and can't see

It makes a live HTTPS connection to see whether the certificate is trusted, and reads the expiry date from public logs. So it has the same blind spot: the date is for the newest certificate logged, which may not be the one installed. The command above is the way to see the installed one.