# CertPost

> CertPost checks the certificate your server actually serves: chain, hostname, and expiry. It alerts you by email or webhook before a certificate causes an outage. Unlimited certificates for $29/month. 3 free forever.

## What it does
- Checks the SERVED certificate on a live TLS handshake, so a renewal that succeeded on disk but never reloaded is still caught.
- Validates the full certificate chain, including intermediate/CA expiry (the failure mode behind the 2020 AddTrust outage), not just the leaf.
- Verifies hostname and SAN match.
- Detects unexpected certificate changes via fingerprint comparison.
- Works on any TLS port: HTTPS 443, SMTP 465/587, IMAPS 993, LDAPS 636, admin panels on 8443, over IPv4 and IPv6.
- Monitors domain registration expiry via RDAP.
- Watches Certificate Transparency logs for newly issued certificates for your domains (issuance alerts, never expiry — CT-based expiry alerts are false positives).
- Sends alerts by email and a generic webhook, with thresholds at 30/14/7/1 days and a weekly all-clear digest.

## Who it is for
Developers, sysadmins, SREs, and agencies who need to know before a certificate breaks. Especially relevant since Let's Encrypt ended expiration-notification emails on 4 June 2025, and as certificate lifetimes drop toward 47 days by 2029 (roughly 9x more renewal events).

## Pricing
- Free: 3 certificates, checked daily, all alert channels. No credit card. Commercial use allowed.
- Team: $29/month — unlimited certificates, hourly checks, up to 5 members, Certificate Transparency alerts, reputation & threat intelligence.
- Agency: $79/month — everything in Team, 15-minute checks, public status pages, priority support.
Flat pricing means unlimited certificates on every paid plan — the cost at 3 certificates is the cost at 300. Against TrackSSL's per-certificate tiers (their published pricing, checked 8 August 2026), that is around 17% cheaper at 80 certificates and around 60% cheaper at 200, and the gap widens with every certificate after that. Below about 20 certificates TrackSSL's entry plan is cheaper than ours.

## How it differs from alternatives
- Uptime tools (UptimeRobot, StatusCake, Pingdom) treat SSL as a checkbox and usually check leaf expiry only. CertPost is a dedicated certificate monitor: full chain, hostname, change detection, custom ports.
- Per-certificate monitors (e.g. TrackSSL) bill by certificate count; CertPost is flat at $29/month for unlimited certificates.
- CertPost checks the served certificate rather than CT logs, avoiding the false-positive expiry alerts that CT-based tools produce for certificates you already rotated out.

Comparison pages also have plain-markdown mirrors for machine readers: fetch https://www.certpost.ai/md/compare/{slug} for any /compare/{slug} page.

## Key pages

- [Home and instant free check (paste a domain, no signup)](https://www.certpost.ai/): the product and the free checker
- [47-day certificate readiness check](https://www.certpost.ai/47-day-certificate-readiness): Free 47-day certificate readiness check: is this host renewed by automation or by hand, and how many hand renewals a year the 200, 100 and 47-day ceilings mean.
- [ACME readiness check](https://www.certpost.ai/acme-readiness-check): Free ACME readiness check for Let’s Encrypt: does CAA permit the CA, does port 80 answer on the HTTP-01 path, and is _acme-challenge delegated for DNS-01.
- [Certificate decoder (runs in your browser)](https://www.certpost.ai/certificate-decoder): Free certificate decoder: paste a PEM or DER and read the subject, issuer, expiry, SANs, key size, and fingerprint. Decoded in your browser, never uploaded.
- [CSR generator (your key never leaves the browser)](https://www.certpost.ai/csr-generator): Free CSR generator: EC P-256 or RSA 2048 key pair and certificate signing request, created by WebCrypto in your browser. The private key never leaves your machine.
- [Free SSL checker (what visitors actually receive)](https://www.certpost.ai/ssl-checker): Free SSL checker: see the certificate your server presents — expiry, full chain, hostname match, and TLS grade. No signup. Monitor it afterward, 3 certs free.
- [SSL expiry checker (live certificate, not the log)](https://www.certpost.ai/ssl-expiry-checker): Check SSL certificate expiry from a live TLS connection, exact date and days left. Catch failed reloads Let's Encrypt no longer emails you about. Free, no signup.
- [SSL chain checker, full chain, not just the leaf](https://www.certpost.ai/ssl-chain-checker): Free SSL chain checker: validate leaf, intermediates, and root the way browsers do. Catch missing or expired intermediates that break some clients only. No signup.
- [Pricing](https://www.certpost.ai/pricing): free tier and the three paid plans
- [For agencies](https://www.certpost.ai/agencies): client website monitoring for agencies and care plans — flat pricing, external checks, whole client list in one paste
- [Free SSL grade](https://www.certpost.ai/ssl-labs-alternative): SSL Labs & securityheaders.com alternative
- [SSL monitoring guide](https://www.certpost.ai/ssl-monitoring): what SSL monitoring is, what to watch, and how it differs from uptime monitoring, with linked deep-dives at /ssl-monitoring/{topic}
- [Best SSL monitoring tools 2026](https://www.certpost.ai/alternatives/ssl-monitoring-tools): a roundup comparing the main SSL certificate monitoring tools; more at /alternatives/{slug}
- [Embeddable SSL status badge](https://www.certpost.ai/badge): a free live SSL badge for any site: shows valid, expiring, or expired and links to a full check, one line of HTML
- [AI readiness checker](https://www.certpost.ai/ai-readiness-checker): a free scan of whether a site gives AI agents clean, machine-readable pages and discovery files
- [Developer docs](https://www.certpost.ai/docs): host and port syntax, which TLS ports are read, the alert schedule, the webhook payload, and the free /api/check endpoint
- [Certificate Lifecycle Management Vs Monitoring](https://www.certpost.ai/compare/certificate-lifecycle-management-vs-monitoring): comparison and migration guide
- [Certimon Alternative](https://www.certpost.ai/compare/certimon-alternative): comparison and migration guide
- [Certspotter Alternative](https://www.certpost.ai/compare/certspotter-alternative): comparison and migration guide
- [Hyperping Ssl Monitoring](https://www.certpost.ai/compare/hyperping-ssl-monitoring): comparison and migration guide
- [Keychest Alternative](https://www.certpost.ai/compare/keychest-alternative): comparison and migration guide
- [Lapsezero Alternative](https://www.certpost.ai/compare/lapsezero-alternative): lifecycle automation vs watching the certificate that is served
- [Lets Encrypt Expiry Emails Ended](https://www.certpost.ai/compare/lets-encrypt-expiry-emails-ended): what to do since 4 June 2025
- [Oh Dear Alternative](https://www.certpost.ai/compare/oh-dear-alternative): per-site bundles vs flat certificate coverage
- [Pingdom Ssl Monitoring](https://www.certpost.ai/compare/pingdom-ssl-monitoring): comparison and migration guide
- [Red Sift Alternative](https://www.certpost.ai/compare/red-sift-alternative): comparison and migration guide
- [Site24x7 Ssl Monitoring](https://www.certpost.ai/compare/site24x7-ssl-monitoring): comparison and migration guide
- [Trackssl Alternative](https://www.certpost.ai/compare/trackssl-alternative): pricing and feature comparison
- [Uptimerobot Ssl Monitoring](https://www.certpost.ai/compare/uptimerobot-ssl-monitoring): what uptime checks miss about certificates
- [Xitoring Ssl Monitoring](https://www.certpost.ai/compare/xitoring-ssl-monitoring): comparison and migration guide
- [SSL/TLS glossary](https://www.certpost.ai/glossary): plain-English definitions of 21 certificate terms (chains, SANs, wildcards, revocation, HSTS, cipher suites, and the major CAs), each with a named source
- [SSL error fixes](https://www.certpost.ai/ssl-errors): step-by-step fixes for 10 SSL/TLS errors (expired, broken chain, protocol mismatch, untrusted) with exact commands
- [Live certificate status for well-known services](https://www.certpost.ai/status/github-certificate): hourly-checked certificate facts (expiry, issuer, chain, TLS versions) for GitHub, Google, Netflix, and 17 other services at /status/{service}-certificate
- [Is it down? SSL check for popular services](https://www.certpost.ai/is-ssl-down): live up/down/expiring SSL verdict for GitHub, Google, and 18 other services at /is-ssl-down/{service}, rechecked hourly
- [Blog](https://www.certpost.ai/blog): guides and postmortems
- [FAQ](https://www.certpost.ai/faq): common questions

## Contact
Support: support@certpost.ai