Expired certificates remain one of the most preventable outages in computing, and with lifetimes dropping to 47 days by 2029 the number of renewal events every team handles is about to increase eightfold. Here is what is available, grouped by how much work you want to do.
Comparison at a glance
| Tool | Type | Finds unlisted hostnames? | Price |
|---|---|---|---|
| Qualys SSL Labs | One-off grader | No | Free |
| openssl + cron | DIY script | No | Free, plus your time |
| Prometheus blackbox_exporter | Self-hosted metric | No | Free, self-hosted |
| Zabbix | Self-hosted monitoring | No | Free, self-hosted |
| Uptime Kuma | Self-hosted uptime + cert | No | Free, self-hosted |
| UptimeRobot | Hosted uptime + cert | No | Free tier; paid from ~$7/mo |
| TrackSSL | Dedicated cert monitor | No | From ~$5/mo |
| Bastion | External monitor, certs included | Yes (CT logs) | From $25/mo |
| ManageEngine / Venafi / DigiCert | Certificate lifecycle management | Partly (network scans) | Enterprise |
Free one-off checks
1. Qualys SSL Labs
The deepest free TLS analysis available: chain validity, expiry, protocol versions, cipher suites and known attacks, graded A+ to F. Nothing beats it for understanding one host's configuration properly.
Not a monitor. No scheduling, no alerts, no history. Use it when you want to know why something is wrong, not to find out that it is.
2. The openssl one-liner
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -enddateAnswers the expiry question for one host in a second, works against internal hosts, and needs no account. This is the building block every DIY script wraps.
Self-hosted and open source
3. Prometheus blackbox_exporter
If you already run Prometheus, this is close to free. The exporter probes an endpoint and
exposes probe_ssl_earliest_cert_expiry as a metric; a single Alertmanager rule
covers every target you scrape:
(probe_ssl_earliest_cert_expiry - time()) / 86400 < 14Best for: teams with existing Prometheus infrastructure. Weakness: targets are a config file someone maintains by hand.
4. Zabbix
Zabbix has built-in certificate validation items that check expiry and chain validity on a schedule, with its full alerting and escalation stack behind them. It is a heavyweight platform, so this makes sense if Zabbix is already your monitoring system, and very little sense if it is not.
5. Uptime Kuma
A popular self-hosted uptime monitor with a clean interface, Docker deployment in minutes, and certificate expiry notifications included per monitor. For a small team that wants a dashboard on a cheap VPS rather than a subscription, this is the friendliest option here.
Hosted services
6. UptimeRobot and general uptime monitors
Most uptime monitoring services (UptimeRobot, Better Stack, Pingdom and peers) include certificate expiry alerting for the endpoints you already monitor. If you run one of these already, switching the setting on is the highest-value five minutes on this page.
Limitation: it watches what uptime monitoring watches, which is your customer-facing endpoints. The certificate that expires is rarely one of those.
7. TrackSSL
A small, focused, inexpensive service that does exactly one thing: watch a list of hostnames and email before their certificates expire, with change notifications when a certificate is replaced. No infrastructure, no configuration to speak of. If your requirement is precisely "alert me before these twenty certificates expire," this is the least complicated way to meet it.
8. Bastion
That's us, so here is the honest scope. Bastion is not a certificate manager: it does not issue, deploy or renew anything. It checks the live certificate each hostname actually serves from the outside, warns at 30/14/7/3 days, and flags certificates issued by CAs you do not normally use. The difference that matters is where the hostname list comes from: Bastion discovers hostnames from certificate transparency logs on domains you have verified you own, rather than asking you to maintain the list. It also runs header, email authentication, DNS and exposed-service checks in the same scan, so certificates are one section of a broader report rather than the whole product. From $25/month.
Enterprise certificate lifecycle management
9. Venafi, ManageEngine Key Manager Plus, DigiCert Trust Lifecycle
A different category: these discover certificates across internal networks, hold private keys, automate issuance and deployment to servers and appliances, enforce crypto policy, and integrate with internal PKI. Monitoring is a minor feature of a much larger platform.
You need this tier when you have thousands of certificates including internal ones, must enforce policy centrally, and need automated deployment to devices that cannot speak ACME. Pricing is enterprise and quote-based. For anyone else it is substantial overkill.
The question that actually predicts outages
Most tools here monitor a list you give them. That is fine, and it fails in a
specific way: the certificate that expires is almost never on the list. It is on
api-legacy, or the status page, or a regional domain from three years ago, or a host
someone stood up during an incident and never documented. Every tool above will report a clean
green dashboard while that certificate expires, because nobody added it.
So when comparing, ask three questions in this order:
- Where does the hostname list come from? Discovery from certificate transparency logs beats a manually maintained list, because CT logs record every publicly issued certificate for your domains whether or not you knew about it.
- Does it check the deployed certificate or the renewal record? Automation reporting success is not the same as the internet serving the new certificate. A load balancer or CDN edge holding a stale copy is a common failure that only an external check catches.
- Does alerting escalate? One email 30 days out gets archived. A useful schedule is 30, 14, 7 and 3 days, with the last one going somewhere a human will actually see it.
The full reasoning behind those three, including the free and DIY paths, is in how to monitor certificate expiry.
Frequently asked questions
What is the best free SSL certificate monitoring tool?
For a hosted free option, most uptime monitors (UptimeRobot and similar) include certificate expiry alerts on their free tiers. For self-hosting, Uptime Kuma is the easiest to deploy, and Prometheus blackbox_exporter is the best fit if you already run Prometheus, using the probe_ssl_earliest_cert_expiry metric with an Alertmanager rule. All of them require you to maintain the hostname list yourself.
How do I monitor SSL certificate expiration across many hostnames?
Use a tool that builds the hostname list for you rather than one you feed manually. Certificate transparency logs record every publicly issued certificate for your domains, so monitors that read CT logs find hosts your inventory missed. Then check the live handshake per hostname from outside, since renewal automation can report success while a stale certificate is still deployed at a CDN edge or load balancer.
What is the difference between certificate monitoring and certificate lifecycle management?
Monitoring watches certificates and tells you when one is about to expire or has changed unexpectedly. Certificate lifecycle management (Venafi, ManageEngine, DigiCert Trust Lifecycle) additionally issues certificates, stores private keys, deploys them to servers and appliances, and enforces crypto policy. CLM platforms are priced for enterprises with thousands of certificates including internal PKI; most teams only need monitoring plus ACME automation.
How often should certificate monitoring run?
Daily is sufficient for expiry, and hourly is worth it if you also want to catch unexpected certificate changes quickly, such as a certificate issued by a CA you do not use. What matters more than frequency is the alert schedule: 30, 14, 7 and 3 days before expiry, escalating, so the final warning reaches a human rather than an inbox filter.