SSL certificate monitoring that warns you before the padlock breaks
DomainChest reads the live certificate on every domain you track and emails you well before it expires — so visitors never hit a “Your connection is not private” warning.
Read from the live handshake
Every certificate is read straight from a real TLS connection on port 443 — the same one a browser makes — so the expiry date is always the one your visitors actually see, not a stale record.
Independent of auto-renewal
Automated renewal fails silently more often than anyone expects: a broken cron job, an expired API token, a DNS change. An outside monitor catches that and warns you before the certificate lapses.
Certificate Transparency alerts
DomainChest watches public CT logs for your domains and flags newly issued certificates — an early signal of both a renewal you forgot and a certificate someone issued that you didn't.
Subdomain certificate discovery
It surfaces certificates found for subdomains of your domains too, so a forgotten api. or staging. host with an expiring cert doesn't slip through unwatched.
Why certificate expiry still catches teams out
Most certificates are set to renew automatically, and most of the time they do. The problem is the failure mode: when auto-renewal breaks, it breaks quietly. There's no error in your inbox — just a certificate that quietly counts down to zero and then takes the site with it.
When a certificate expires, browsers stop trusting the site immediately and show a full-page security warning that blocks visitors cold. Nothing is permanently broken, but the site is effectively down until it's renewed — and API calls to it start failing too.
How DomainChest monitors your certificates
Add a domain once and DomainChest checks its live certificate on a schedule, records the expiry date, and counts down. You choose how early you want to hear about it — 30, 14, 7, and 1 day before expiry by default — over email, Slack, or webhook.
Because the check is an independent, outside-in TLS handshake, it doesn't care how your certificate is issued or renewed. Let's Encrypt, a paid CA, a load balancer, a CDN — if a browser can see the certificate, so can DomainChest.
Frequently asked questions
How is this different from my certificate authority's own renewal?
Your CA issues and renews the certificate; it doesn't independently verify that the renewed certificate is actually being served. DomainChest checks the live certificate from the outside, so it catches the case where renewal succeeded but the new certificate never got deployed — or where renewal failed entirely.
Does it monitor certificates on subdomains?
Yes. Alongside the certificate on the domain itself, DomainChest surfaces certificates discovered for subdomains via Certificate Transparency logs, so a forgotten host with an expiring certificate still shows up.
What is Certificate Transparency monitoring?
Public CT logs record every certificate issued for a domain. DomainChest watches those logs for your domains and alerts you when a new certificate appears — useful both as a heads-up that renewal happened and as an early warning if a certificate you didn't request was issued.
How early will I be warned before a certificate expires?
By default you're warned 30, 14, 7, and 1 day before expiry, and you can adjust that schedule. Alerts go out over email on every plan, and over Slack and webhook on paid plans.
Related: Free SSL certificate checker · What happens when an SSL certificate expires · Alerts: email, Slack & webhook
Never serve an expired certificate again
Store your domains in a chest, so you never forget one again.
Start free — 3 domains