Stop certificate expirations before they become incidents.
Know before a certificate expires. Alerts by email, plus Slack and Discord on paid plans.
Nothing to install. No server access needed.
* Demo account with example sites, not customers.
What we check, on every plan
- Expiry
- When each certificate ends, checked twice a day.
- Trust
- A trusted issuer, not revoked, a name that matches the domain, and TLS 1.2 or newer.
- Certificate chain
- The intermediate certificates the server sends, in order and none expired.
- Every name on the certificate
- The SANs it covers and where each one points in DNS.
- Other names under your domain
- Names with certificates in the public Certificate Transparency logs.
- Your domain name and DNS
- When the domain name ends, its nameservers, transfer lock, DNSSEC and CAA records.
Plans
Free forever for up to 3 domains. Paid plans are yearly subscriptions you can cancel anytime.
FREE
- Expiry emails at 30 days and expiry
- Domain name end date shown, no reminder emails
- No certificate problem emails
- Shows when a certificate is replaced, without the details
- Revocation check with the certificate authority (OCSP or CRL)
- 1 year of daily certificate history
- DNS, SANs and other names refresh once a day
No card needed.
STARTER
- Expiry emails at 30 days, 14 days, 7 days and expiry (default)
- Choose the alert days, or turn alerts off, for each domain
- Alerts and the monthly summary to up to 3 email addresses
- Alerts also in Slack or Discord (1 channel)
- Domain name renewal reminders (30 and 7 days before it ends)
- Problem emails: when confirmed, a 7-day reminder, and when fixed
- Certificate change history and emails: issuer, key and names, routine or unexpected
- Revocation check with the certificate authority (OCSP or CRL)
- 1 year of daily certificate history
- Recheck refreshes DNS, SANs and other names on demand
PLUS
Everything in Starter, with:
- Alerts and the monthly summary to up to 5 email addresses
- Alerts also in Slack or Discord (up to 3 channels)
PRO
Everything in Plus, with:
- Alerts and the monthly summary to up to 10 email addresses
- Alerts also in Slack or Discord (up to 10 channels)
- Certificate report for audits (PDF and CSV, files your auditor can verify), from 2 years of daily history (up to 5 years)
- Owner, purpose and client groups on each domain; reports per group, owner or purpose
- See a sample report (PDF)
Questions
Do I need to install anything or give you access to my server?
No. CertAvert connects to your domain like any visitor (on port 443, or another port you choose) and reads the public certificate your server already shows to everyone. There are no agents to install, no passwords or API keys to share, and no DNS or code changes. Add domains one at a time, or paste a list or load a CSV file, on any port, like example.com:8443.
I use auto-renewal. Do I still need monitoring?
Auto-renewal can fail quietly after DNS changes, server moves or config updates. CertAvert checks the certificate your server is actually serving, so you find out before your visitors do.
Is CertAvert really free?
Yes. The Free plan monitors up to 3 domains with no time limit and no card needed. If you need more, Starter ($50/year, 10 domains), Plus ($100/year, 20 domains) and Pro ($150/year, 50 domains) are yearly subscriptions you can cancel anytime.
How does billing work for paid plans?
Paid plans are billed once a year through Paddle, our reseller, and renew automatically until you cancel. You can upgrade anytime and pay only the difference for the rest of your year. Downgrades and cancellations take effect at your renewal date, so you keep what you paid for. Every payment comes with a 14-day money-back guarantee. If a plan ends, domains above the new limit are paused, never deleted.
Which emails will I get, and how often?
It depends on your plan:
| Free | Paid plans | |
|---|---|---|
| Certificate expiring | 30 days before | 30, 14 and 7 days before, or up to 3 days you choose |
| Certificate expired | Yes | Yes |
| Certificate problem | No | When confirmed, a reminder after 7 days, and when fixed |
| Domain name renewal | No | 30 and 7 days before, and when it ends |
| Monthly summary | Yes (can be turned off) | Yes, to the alert addresses you pick |
| Sent to | Your account email | Starter up to 3, Plus up to 5 and Pro up to 10 addresses |
| Also posted to Slack or Discord | No | Starter 1, Plus 3 and Pro 10 channels, the same alerts |
Short-lived certificates (under 90 days) are emailed later, at no more than a third of their lifetime, so routine renewals don't set them off.
Which certificate problems send an email, and how fast?
On paid plans, we check again about 30 minutes after first seeing a problem and email you only if it is still there. If it isn't fixed, one reminder after 7 days, then one email when it is.
| Problem | |
|---|---|
| Self-signed or untrusted certificate, missing intermediate | Yes |
| Certificate revoked by its certificate authority | Yes |
| Name mismatch, certificate not valid yet | Yes |
| Can't connect, timeout, name doesn't resolve, no certificate | Yes |
| Expired certificate | Its own email, right away |
| TLS versions, DNS records, other names | Shown on the Domains page only |
Problem emails can be turned off for any domain in its Expiry alerts tab. The Free plan gets expiry emails only.
Can my team get the alerts too?
Yes, on paid plans: Starter up to 3, Plus up to 5 and Pro up to 10 email addresses, for example you, a colleague and a shared team inbox. Each address gets its own email and is used only after someone at that address confirms it. The domain name renewal reminders go to every one of those addresses too, and you pick which of them also get the monthly summary, so your web designer or hosting person can see it. Alerts can also be posted to Slack or Discord channels (Starter 1, Plus 3 and Pro 10). Free sends alerts to your account email.