Domain Expiry and SSL Certificate Monitoring You Can Self-Host

Description and use

A daily cron job that polls domain and SSL certificate expiry dates and alerts before thresholds provides reliable, self‑hosted monitoring to prevent outages caused by expired certificates or domains.

Problem

A site can go dark when its TLS certificate or domain registration expires, yet registrar and CA renewal emails are unreliable and insufficient as a single safety net.

Outcome

Implementing a daily cron job that polls domain and certificate expiry dates and alerts before thresholds prevents outages caused by expired certificates or domains, offering a low‑cost, self‑hosted alternative to paid monitoring services.

Workflow

• 1. Schedule a cron job to run daily.
• 2. In the job, perform a WHOIS (or RDAP) lookup for each domain to obtain the expiration date.
• 3. Compare the expiration date to the current date; if days remaining ≤ EXPIRY_WARNING_DAYS (default 90), generate an alert message.
• 4. Open a TLS connection to the host, read the certificate’s notAfter field, compare to current date; if days remaining ≤ EXPIRY_WARNING_DAYS, generate an alert.
• 5. Send alerts via a chosen channel (e.g., Telegram bot).
• 6. Optionally, set up a dead‑man’s switch that pings if the monitoring job hasn’t reported within its expected window.

Evidence

A site going down because its TLS certificate expired is an embarrassing kind of outage: nothing actually broke.

Source

Both are avoidable months in advance. Both are, in practice, still one of the more common ways a working site goes dark, because the thing that’s supposed to prevent them – an email from the registrar or the certificate authority – has a habit of not doing its job.

Source

Domain expiry and certificate expiry are two different lookups with the same shape: a periodic poll, not a live health check.

Source

Site Pulse defaults EXPIRY_WARNING_DAYS to 90, which leaves enough runway to actually action a renewal, rather than a 7-day warning that lands the same week as three other fires.

Source

A cron job that checks domain and certificate expiry and pings you before a renewal lapses is a small build – and it’s the kind of unattended automation I set up so nobody finds an outage from a customer complaint.

Source