SSL certificate monitoring tools: an honest comparison

Disclosure first: we make one of the tools on this list. CertPost is ranked where we honestly think it belongs, cons included, and for several situations below our recommendation is not us. You can judge whether that makes this list more useful or less.

How we compared them

Five criteria, and the first one carries the most weight because it's where real outages come from:

1. Does it check the certificate actually served on the live connection? Renewal logs and on-disk checks miss the failure that bites hardest: the cert renewed successfully but the service never reloaded and kept serving the old one. If a tool watches renewal jobs instead of the wire, it validates your automation, not your site. (We've seen this one from the inside.)
2. Alerting you'll actually receive. Email, Slack, webhooks — and whether alerts fire with enough lead time to act. A surprising number of homegrown setups mail root on a box with no mail server.
3. Coverage beyond the expiry date. Full chain including intermediates, hostname/SAN coverage, TLS configuration.
4. Cost, including your time. Free tiers, price per certificate, and the setup plus maintenance you're signing up for.
5. Fit. Self-hosted vs SaaS, and whether it assumes infrastructure you may not run.

The comparison

The honest rundown

cron + openssl — the right default for one server

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate

Run it daily from a machine that isn't the one serving the cert, alert somewhere humans look, and you've got 80% of what any paid tool does. This is what half of r/sysadmin will tell you to do, and they're not wrong.

Where it breaks down: you now own a small monitoring product. The failure modes are the same ones that break renewal — the cron stops running, the alert path rots, the box it runs on gets decommissioned. And it checks exactly what you wrote it to check: the day a hostname mismatch or a dropped intermediate takes you down instead of expiry, the one-liner shrugs. Fine at one server. At ten domains across three providers it becomes the spreadsheet problem wearing a costume.

Uptime Kuma — best self-hosted answer

Genuinely good, free, and the default recommendation in r/selfhosted. Certificate expiry alerts are built in, notification channels are endless. One user called it a sledgehammer to crack a nut, which is fair: you're running a full uptime-monitoring stack to get cert alerts. If you already want the stack, that's a feature. You're also hosting it yourself — which means its uptime, its updates and its alerting path are now also your job. Monitoring your certs with a service whose certs you also maintain has a certain circularity to it.

Prometheus blackbox / ssl exporter — correct if you're already there

If your team runs Prometheus, this is the answer and you don't need this article: probe_ssl_earliest_cert_expiry, an Alertmanager rule, done. It checks the served cert, it's battle-tested, it's free. If you don't already run Prometheus, standing it up to watch certificates is like buying a combine harvester for a window box.

Nagios check_ssl_cert — old, ugly, works

The matteocorti plugin has been catching expired certs since before Let's Encrypt existed, and it checks more than expiry — chain, OCSP, specific issuers. Written by someone who has clearly explained an expired cert to a customer at 6am. Same caveat as Prometheus: it earns its place only inside an existing Nagios/Icinga shop.

UptimeRobot — uptime tool first, cert checkbox second

Excellent free uptime monitoring, and the SSL expiry alert is a tick-box on a paid plan. If your actual question is "is my site up?", start here. If your question is "will my certificates surprise me?", the checkbox answers less than you think — no chain validation, no config checks, and expiry alerts arrive on UptimeRobot's schedule, not yours. Longer comparison here.

Oh Dear — polished, broader than certs

A well-built site-health suite: uptime, broken links, mixed content, and proper certificate checks including the chain. It's priced like the suite it is, which makes sense if you want the whole package and less sense if certificates are your only worry. Comparison here.

TrackSSL — the closest direct competitor

Does one thing — certificate expiry monitoring — and has done it for years. Checks the served cert, emails you before expiry. Less coverage on chain/TLS-config detail, and the interface shows its age, but it's a sane product. Here's our side-by-side, written before you ask by us.

CertPost — ours

What we built: checks the certificate your server actually serves on a live connection — full chain with intermediates, hostname/SAN coverage, TLS configuration — grades it, and alerts by email or webhook before expiry or when the grade drops. The instant check is free without signup; watching is free for 3 certificates, then $9/month for up to 100.

Cons, honestly: we're the youngest tool on this list by some distance. SaaS only — if you need self-hosted, use Uptime Kuma. No status pages on the personal tier. No SMS alerts. And at enterprise certificate-lifecycle scale (thousands of certs, ACME orchestration, approval workflows) we are the wrong species of tool entirely — that's Venafi/Keyfactor territory.

Which one, then

• One personal server: the cron one-liner. Really.
• Homelab / self-host on principle: Uptime Kuma.
• Team already on Prometheus or Nagios: use what you run.
• You mainly need uptime monitoring: UptimeRobot, and treat its SSL checkbox as a bonus.
• You want site health broadly, budget permitting: Oh Dear.
• Certificates are the specific thing that's bitten you — renewal that failed silently, the cert that renewed but never got served, the Let's Encrypt emails that no longer come — that's the case we built CertPost for.

Whatever you pick: watch the wire, not the log. Every horror story in this genre starts with automation that reported success.