# Let's Encrypt stopped sending expiry emails: how to get warned now For years, Let's Encrypt emailed you when a certificate was about to expire without having been renewed. That email was often the only warning that automatic renewal had quietly broken. **It ended on 4 June 2025.** Nothing replaces it unless you set something up. ## Why Let's Encrypt stopped Its announcement gave four reasons: most certificates now renew automatically; keeping millions of email addresses tied to certificate records was a privacy cost; running the service cost tens of thousands of dollars a year; and it added infrastructure that could go wrong. Fair reasons, but the people who most needed the email, those whose renewal had failed and didn't know, now find out when visitors see a browser warning. ## What you lose The email warned about certificates that **weren't renewed**. What still isn't covered either way: - **A certificate renewed but never installed.** Certbot succeeds, but the server never reloads, or a load balancer keeps the old file. Let's Encrypt never knew about that. - **Certificates from other CAs** on the same domain. - **Hosts nobody remembers**: an old subdomain still serving a certificate that expires next week. ## Free replacements - **Red Sift Certificates Lite.** Let's Encrypt itself recommends it: free monitoring for up to 250 certificates. - **Let's Encrypt's own list of monitoring options** includes UptimeRobot, Datadog, TrackSSL and several smaller services and scripts. - **Nameward's free plan** watches one domain: every hostname found in the public certificate logs, whether each serves its newest certificate, and alerts by email, Slack or Teams before anything expires. Whichever you pick, monitor **what the server serves from the outside**, not what your ACME client says it did. ## Check it yourself See when a server's certificate expires: ``` openssl s_client -connect example.com:443 -servername example.com /dev/null \ | openssl x509 -noout -enddate ``` Fail if it expires within 30 days (handy in a cron job or CI check): ``` openssl s_client -connect example.com:443 -servername example.com /dev/null \ | openssl x509 -noout -checkend 2592000 ``` On a server using Certbot: ``` sudo certbot certificates # each certificate and its days left sudo certbot renew --dry-run # does renewal still work? ``` If `certbot certificates` shows a fresh date but `openssl s_client` shows an old one, the renewal worked and the install didn't. See [certificate renewed but not installed](/guides/certificate-renewed-but-not-installed). ## Make renewals fail loudly - Add a **deploy hook** so the server reloads after every renewal: `certbot renew --deploy-hook "systemctl reload nginx"`. - Keep Certbot's **systemd timer** (or cron job) running, and check its logs after OS upgrades, which sometimes replace it. - Let's Encrypt certificates are getting shorter (64 days from February 2027, 45 days from February 2028), so a broken renewal will be found sooner and hurt sooner. See [100-day SSL certificates](/guides/100-day-ssl-certificates). ## Check your domain The [SSL expiry checker](/tools/ssl-expiry-checker) shows every hostname's certificate, when it expires and whether a newer one was issued but never installed. Free, no signup. ## Sources - [Let's Encrypt: ending support for expiration notification emails](https://letsencrypt.org/2025/01/22/ending-expiration-emails/) - [Let's Encrypt: the expiration notification service has ended](https://letsencrypt.org/2025/06/26/expiration-notification-service-has-ended/) - [Let's Encrypt: monitoring options](https://letsencrypt.org/docs/monitoring-options/) - [Red Sift: Certificates Lite](https://redsift.com/pulse-platform/certificates-lite) - [Certbot user guide](https://eff-certbot.readthedocs.io/en/stable/using.html) - [Let's Encrypt: decreasing certificate lifetimes to 45 days](https://letsencrypt.org/2025/12/03/from-90-to-45/) --- Source: https://nameward.app/guides/lets-encrypt-expiry-emails-stopped (updated 2026-10-30)