Since Let's Encrypt ended expiry emails in June 2025, I've been building TLDix (https://tldix.com), a free external checker that watches the certificate your server actually serves and emails you before it expires.
It also warns when a renewal looks overdue: for example, a 90-day certificate that still hasn't been replaced with less than about four weeks left. Free for 5 domains, no card.
I'm posting here because this community knows renewal failure modes better than anyone. Which failures would you want an external monitor to catch? I'm thinking of cases like the certificate renewing but the server never reloading, or the apex and www serving different certificates.
The certificate expiry check should take into account the whole life of the certificate, 160 hour certificates are only renewed half way through their lifetime (about 3 days).
DNSSEC should be verified and a failure to resolve a domain should be reported.
Thanks, that's a really useful point. You're right: our expiry alerts currently use fixed thresholds (14, 7, 3 and 1 days), so with 160-hour certificates renewed around the halfway mark they would fire on every normal cycle. I'm changing them to scale with the certificate's lifetime, so a short-lived certificate only alerts when it's genuinely late relative to its own renewal window.
On DNS: a domain that stops resolving already shows up as a failed check after repeated failures, but I'll make it a distinct, explicit alert rather than a generic failure. DNSSEC validation is a good idea too, and I've added it to the list.
Shortlived certs are not the only duration other than 90 days. The Let's Encrypt tlsserver profile is currently 45 days. And, cert lifetimes are being shortened across the industry. LE most recently discussed that here: 64-Day Certificate Lifetimes Coming Feb 2027 - Let's Encrypt
Note that Google Trust Services allows ACME clients to choose their cert duration with notBefore and notAfter options. Other CA may offer similar choices.
I believe @MaxHearnden was suggesting adapting to the actual cert's lifetime and not hard-coding based on specific implementations.
They can serve different certs and is perfectly legal to do so. For example, you may have a virtual host for the apex using its own cert and redirecting all requests to the www.
You may wish to review other products and services that offer monitoring. Let's Encrypt describes some but certainly not all. See: Monitoring Service Options - Let's Encrypt
Some offer various alerting methods, for example. And others for various services running on different ports.