Renewed before they expire. Online every day.
SSL Clock watches every certificate and warns you well before the deadline, so a missed renewal never takes your site offline.
Free for 3 sites. No card. Set up in two minutes.
The 2 a.m. call
Expired certificates don't fail quietly. Browsers throw a full-page warning. APIs stop answering. Checkout dies mid-payment. And it always seems to happen on a weekend.
Auto-renew was supposed to fix this. Then a DNS change breaks validation, a cron job dies, or a card on file expires. Nobody notices until the site is down.
SSL Clock notices first.
How it works
- Add your domains. Paste a list or upload a CSV. No agents, no keys, nothing to install.
- Pick where alerts go. Email, Slack, Microsoft Teams, signed webhooks or PagerDuty.
- Get on with your week. We check around the clock and ping you at 30, 14, 7, 3 and 1 day. Change the schedule any time.
Benefits
- Weeks of warning, not minutes. Five reminders before expiry, so a failed renewal is a calm fix on a Tuesday, not a fire drill.
- Broken now? You know now. Expired cert, wrong hostname, broken chain, server unreachable. You get an alert the moment we see it.
- Fix it without a forum search. Every alert comes with a plain-English explanation of what went wrong and the exact steps to fix it.
- Alerts where your team already is. Email, Slack, Teams, webhooks and PagerDuty. Route each site to the right people.
- Nothing to trust us with. We check what the public internet sees. No agents on your servers, no private keys, ever.
What we watch
- Expiry. Reminders at 30, 14, 7, 3 and 1 day, or your own schedule.
- Breakage. Expired, hostname mismatch, broken chain, TLS errors, and hosts that stop answering for 3 checks in a row.
- Unexpected changes. A note when a site starts serving a different certificate, with the old and new issuer.
- New certificates. A daily look at public Certificate Transparency logs for anything newly issued for your hostnames.
- Domain registration. A daily RDAP lookup and warnings at 30, 14, 7 and 1 day before the domain lapses.
Alerts that say what to do
A bare "certificate expired" email sends someone to a search engine. Ours explain the likely cause and the fix, like a missing intermediate, a name that is not on the certificate or a renewal that never reloaded the server. Anyone on the team can act on it.
Five minutes to set up
Sign up, paste your hostnames, choose where alerts go and press Send test. Most people are watching every certificate before their coffee goes cold. Not ready to sign up? Try the free SSL checker on any site first.
Built for how you work
Running client sites? See SSL monitoring for agencies and for MSPs. Running a product? SaaS teams wire us into PagerDuty and the REST API. Running a shop? Online stores keep the padlock on checkout. Alerts go to email, Slack, Microsoft Teams, signed webhooks or PagerDuty.
Renewals are about to get a lot more frequent
Certificates issued since March 2026 last 200 days at most. In 2027 that drops to 100 days. By 2029, 47. More renewals means more chances for one to fail quietly. Read what's changing
Try it on your own site
See your expiry date, issuer and chain in seconds. Free, no signup.
Pricing
Free for 3 sites. $9/mo for 25, $29/mo for 150 with hourly checks, $69/mo for 500. Every plan gets every alert. Cancel any time.
Check a site with the free SSL checker or see pricing. Read the 47-day certificate timeline and Let's Encrypt expiry emails.
FAQ
My certificates auto-renew. Why do I need this?
Because auto-renew fails silently. Expired API tokens, DNS changes, firewall rules and dead cron jobs all stop renewals without telling anyone. We tell you.
Do I need to install anything?
No. Add a domain and we check it from the outside, the same way your visitors' browsers do.
Do you need my private keys?
Never. We only read the public certificate your server already shows every visitor, so there is nothing secret to hand over and nothing to rotate if you leave.
Which certificates can you monitor?
Any certificate served on a public hostname, from any issuer, including Let's Encrypt. Custom ports work too, so mail servers on 465 or 993 and APIs on 8443 are covered.
How often do you check?
Every 6 hours on Free and Starter, and every hour on Pro and Business. Domain registration and Certificate Transparency logs are checked daily.
Can I change when alerts arrive?
Yes. Reminders go out at 30, 14, 7, 3 and 1 day by default, and you can set up to 10 reminder days of your own in Settings.
Where can alerts go?
Email to you and up to 5 more people, Slack, Microsoft Teams, signed webhooks and PagerDuty, on every plan. Each site can have its own destinations.
Is the free plan really free?
Yes. Watch 3 hostnames with every alert channel, no card and no time limit. Upgrade only when you need more.