Let's Encrypt no longer emails you before your certificate expires
Verified 17 Jul 2026
On June 4, 2025, Let's Encrypt sent its last certificate expiration notification email. If you relied on those emails — and 762 million websites' worth of people did — nothing warns you anymore when a renewal quietly fails.
Their advice was blunt: sign up for a third-party monitoring service.
Why this matters even with auto-renew: renewal automation fails silently. A DNS challenge breaks after a provider change. A rate limit hits. certbot renews but nginx never reloads, so the server keeps serving the old certificate while your logs say success. The old emails were how thousands of people found out their automation had been broken for weeks. That safety net is gone.
It is about to matter more: certificate lifetimes are dropping from 398 days to 200 in March 2026, then 100, then 47 days by 2029. Shorter certificates mean renewals happen 9x more often — and every renewal is a chance for the automation to fail.
What to do now:
1. Put your domains into a monitor that checks the certificate your server actually serves — not your renewal logs, and not CT logs (CT-based expiry alerts fire on certificates you already replaced; people switching to the CT-based services have been drowning in false positives).
2. Make sure it validates the full chain and the hostname, not just the leaf expiry date.
3. Send the alerts somewhere your team actually looks: email or your own webhook.
You can see the gap yourself in one line — openssl already ships on every server:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
That prints the expiry of the certificate the server actually serves, not the copy sitting on disk. It is a real check and it costs nothing — but it only reads the leaf date. It does not validate the chain (an intermediate can expire while the leaf is still fine), notice the certificate was swapped, confirm the hostname matches, or alert anyone. A date printed into a terminal nobody watches is not monitoring.
CertPost does exactly this. Paste a domain on the homepage and you'll see the full report — chain, hostname, expiry — in about two seconds, without creating an account. Three certificates are free forever (your apex, www, and API), checked daily, with all alert channels included. Beyond three, Team is $29/month with unlimited certificates.
The two-minute replacement checklist:
1. Sign up free (no card).
2. Paste every hostname you terminate TLS on — apex, www, API, mail, admin panels on odd ports. One per line.
3. Check the dashboard: anything red or amber gets fixed today; everything green is now watched every 6 hours.
4. Add a webhook channel so alerts reach the person on call.
5. Mark hosts with working auto-renew as "auto-renew expected" — reminders stay quiet until 7 days out, real failures still alert immediately.
One more thing the LE emails never did: we also watch your domain registration expiry and Certificate Transparency logs (someone issuing a certificate for your domain that you didn't request is worth knowing about within a day).
Import your domain list in 2 minutes — 3 certificates free, no card.
Start free