For years, Let's Encrypt emailed you when a certificate was about to expire without having been renewed. That email was often the only warning that automatic renewal had quietly broken. It ended on 4 June 2025. Nothing replaces it unless you set something up.
Why Let's Encrypt stopped
Its announcement gave four reasons: most certificates now renew automatically; keeping millions of email addresses tied to certificate records was a privacy cost; running the service cost tens of thousands of dollars a year; and it added infrastructure that could go wrong.
Fair reasons, but the people who most needed the email, those whose renewal had failed and didn't know, now find out when visitors see a browser warning.
What you lose
The email warned about certificates that weren't renewed. What still isn't covered either way:
- A certificate renewed but never installed. Certbot succeeds, but the server never reloads, or a load balancer keeps the old file. Let's Encrypt never knew about that.
- Certificates from other CAs on the same domain.
- Hosts nobody remembers: an old subdomain still serving a certificate that expires next week.
Free replacements
- Red Sift Certificates Lite. Let's Encrypt itself recommends it: free monitoring for up to 250 certificates.
- Let's Encrypt's own list of monitoring options includes UptimeRobot, Datadog, TrackSSL and several smaller services and scripts.
- Nameward's free plan watches one domain: every hostname found in the public certificate logs, whether each serves its newest certificate, and alerts by email, Slack or Teams before anything expires.
Whichever you pick, monitor what the server serves from the outside, not what your ACME client says it did.
Check it yourself
See when a server's certificate expires:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -enddate
Fail if it expires within 30 days (handy in a cron job or CI check):
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -checkend 2592000
On a server using Certbot:
sudo certbot certificates # each certificate and its days left
sudo certbot renew --dry-run # does renewal still work?
If certbot certificates shows a fresh date but openssl s_client shows an
old one, the renewal worked and the install didn't. See
certificate renewed but not installed.
Make renewals fail loudly
- Add a deploy hook so the server reloads after every renewal:
certbot renew --deploy-hook "systemctl reload nginx". - Keep Certbot's systemd timer (or cron job) running, and check its logs after OS upgrades, which sometimes replace it.
- Let's Encrypt certificates are getting shorter (64 days from February 2027, 45 days from February 2028), so a broken renewal will be found sooner and hurt sooner. See 100-day SSL certificates.
Check your domain
The SSL expiry checker shows every hostname's certificate, when it expires and whether a newer one was issued but never installed. Free, no signup.