CertPost, in the
detail you need.

Hosts and ports

A target is a host, optionally followed by a port. Paste a bare domain, a full URL, or host:port. CertPost strips the scheme and the path and reads the certificate the server actually serves.

example.com          checks port 443
mail.example.com:465 checks SMTP over TLS
10.0.0.1:8443        an IP literal on a custom port
https://example.com  the scheme and path are ignored

When no port is given, CertPost uses 443. Any TLS port works, including mail and admin ports (SMTP, IMAPS, LDAPS, 8443), over IPv4 and IPv6. A host that only resolves inside a private network is refused, since checks run from the public internet.

What a check reads

Each check reads the served certificate from a real TLS handshake, not a renewal log: the expiry date and days remaining, the full chain including intermediates, whether the hostname and SANs match the name you checked, and the issuer. It also grades the TLS configuration from A to F.

Alert schedule

Expiry alerts fire once as the certificate crosses each threshold, at 30, 14, 7, 1 days before expiry. Each event is sent once and deduplicated, and a renewed certificate re-arms its own reminders. A weekly all-clear digest confirms nothing is wrong, so silence never means broken.

Webhook payload

A webhook channel receives a POST with a JSON body when an event fires. The content type is application/json.

{
  "event": "expiry_threshold",
  "threshold": 14,
  "daysRemaining": 14,
  "subject": "example.com expires in 14 days",
  "monitor": { "host": "example.com", "port": 443 },
  "cert": {
    "issuer": "R11",
    "notAfter": "2026-09-20T12:00:00.000Z",
    "lastError": null
  },
  "timestamp": "2026-08-20T09:00:00.000Z"
}

event is the kind of alert, threshold and daysRemaining are the day it crossed and the days left, monitor is the host and port, and cert carries the issuer, the notAfter date, and the last error if the check failed.

The check API

The same one-off check that runs on the homepage is a public endpoint at /api/check, mirrored at the version-stable /api/v1/check for scripts. POST a JSON body with a target. No account or key is needed. It is rate limited to 20 requests a minute per address.

curl -s https://www.certpost.ai/api/v1/check \
  -H 'content-type: application/json' \
  -d '{"target":"example.com:443"}'

The response is pinned by a version field. status is one of ok, expiring, expired, or error.

{
  "version": 1,
  "host": "example.com",
  "port": 443,
  "status": "ok",
  "daysRemaining": 61,
  "grade": { "grade": "A", "weaknesses": [] },
  "cert": { "notAfter": "2026-10-20T12:00:00.000Z", "hostnameMatch": true }
}

Free tier

An account watches 3 certificates free forever, checked daily, with every alert channel and no card. Paid is a flat price for unlimited certificates. See pricing.