Expiry Watch

Know before a certificate or domain expires

Expiry Watch checks your domains every day and emails you before the TLS certificate or the registration runs out. Free for up to 3 domains.

Just want to look? Check a certificate now or look up a domain’s expiry.

Then 14, 7, 3 and 1 day before, for the certificate and the domain.

What it watches

Four things that take sites offline, checked once a day.

Certificate expiry: The TLS certificate your site serves on port 443. You get an email 30, 14, 7, 3 and 1 day before it expires.
Certificate problems: One email if the certificate stops being valid: expired, a broken or untrusted chain, or a name that doesn’t match.
Domain registration: The expiry date the registry publishes over RDAP, on the same 30, 14, 7, 3 and 1 day schedule. Many country-code domains, like .io and .de, publish none; for those you get certificate alerts only.
Failed checks: If we can’t reach the site for 3 days in a row, one short note. A failed check is never reported as an expiry.

How alerts work

Add a domain. Enter it with your email address. We send a link to confirm both; nothing is watched until you click it.
We check it daily. Every day at about 06:00 UTC: the certificate from our checker, the registration from the registry.
You get the alerts. One email per threshold per expiry date, never a daily nag. Each says what expires, when, and what to check.
Renew. Once a renewed certificate or registration shows up, its new expiry date starts a fresh schedule.

Why now

Certificate lifetimes are shrinking fast.

In April 2025 the CA/Browser Forum voted to cut the longest a public TLS certificate may last, step by step, from 398 days to 47. Shorter certificates are safer, but every renewal is another chance for one to slip.

Read the 47-day guide Source: Ballot SC-081v3

Until 15 Mar 2026 398 days
Since 15 Mar 2026 now 200 days
From 15 Mar 2027 100 days
From 15 Mar 2029 47 days

At least 8 renewals a year at 47 days

Free, and Pro later

The free plan is the whole product for up to 3 domains. Pro is for people who need more.

Free

Up to 3 domains per email address
Daily certificate and registration checks
Every alert: 30, 14, 7, 3 and 1 day, problems, failed checks
One-click unsubscribe in every email

Start watching

Pro (early access)

For watching more than 3 domains. It isn’t open yet: leave your address and we’ll email you once when it is.

Pricing for Pro will be on the pricing page before it opens.

What it won’t do

Plain limits, so nothing surprises you later.

Alerts, not guarantees: We tell you what we found and when it’s due. Renewing is still up to you, and an email can land in spam or arrive after you needed it.
Once a day, from one place: Checks run daily from one server. A certificate replaced at noon shows up the next morning, and a CDN can serve other regions a different certificate.
Failures are reported, never guessed: If a check fails, we keep the last good result, say the check failed, and never call that an expiry or a fix.
Port 443, public sites: We check HTTPS on port 443 for public domain names. Mail servers, other ports and internal hosts are out of scope.
Most urgent first: If a busy day would exceed our email sending limit, the most urgent alerts go out first and the rest follow the next day.

Questions

Short answers to the usual ones.

Anything else: hello@boringutils.com

What does it cost?

Watching up to 3 domains is free, with every alert. Pro, for more domains, is in early access: join the list to hear when it opens.

Why don’t I get a daily email?

On purpose. You get one email per threshold (30, 14, 7, 3 and 1 day before expiry), one if the certificate breaks, and one if we can’t reach the site for 3 days. Quiet means nothing is due.

I added a domain that expires in 10 days. What happens?

The next daily check sends the most urgent alert already due, here the 14-day one, and the rest follow on schedule. You don’t get a burst of old alerts.

How do I stop watching a domain?

Every email has a link to stop watching that domain and a one-click unsubscribe from everything. Either takes effect immediately.

What do you store?

Your email address, the domains you watch, and what each daily check found (kept for 90 days). We use the address only for these alerts and the confirmations around them.

Does it work with Let’s Encrypt?

Yes, with any certificate a public site serves. Let’s Encrypt stopped sending its own expiry reminder emails on June 4, 2025, which is one reason this exists.

Free checks, any time

The same checks Expiry Watch runs, for any domain, right now.