Free SSL expiry lookup, and Slack alerts on Team

What you can do without an account

Open the certificate checker and enter a public domain. The page shows issuer, names, not-before, not-after, days until expiry, and any upcoming expiries inside 30 days from that one page of logs. It does not connect to the domain. The result is cached for about a day. Looking up the same domain again in that window does not call the log source, so a shared link is cheap to reopen.

There is a limit on uncached lookups per IP and a separate daily cap for the whole site. When either cap is hit, you get a short page that asks you to try later or create an account, and the checker does not call upstream. That cap is not the same counter as customer monitoring. A busy public checker does not pause probes or paid log refreshes.

Free, in this sentence, means the lookup. It does not mean a free Slack notification. If a page on the wider web promises free SSL expiry alerts into Slack with no plan attached, this product is not that promise. The lookup is free. The ongoing alert is paid.

What an account adds before any alert

Sign in with a one-time email link, or with Google when that button is shown, or with a password after the email is confirmed. Create an organization and add the domain. The scheduler queues Certificate Transparency refreshes and stores pages over time, not only the first page. Expired rows stay. You can filter and export CSV. Viewers can read that inventory. Owners and admins can add domains and people.

The free plan still does not send alerts. It includes a small number of manual live checks and does not schedule them. That is enough to compare one host with the logs when you are deciding whether the inventory matches production. It is not a notification system. If nobody is watching the page, a date can pass quietly.

Email, then Slack

Pro and Team can email selected members when a stored certificate is 30, 14, 7, or 1 days from not-after, and when it is already expired. You choose the members. The mail is sent by the service, not by opening a connection from the certificate host. There is no customer API to poll instead.

Team can add Slack, Microsoft Teams, Discord, or a generic webhook. You paste the webhook URL the chat product gives you. Certwatch stores it so it can post later, and it can send a test from the alerts page. The same expiry events can drive those posts. A webhook is a URL you control. Certwatch does not join a workspace on your behalf and it does not read channel history.

Alerts can wait until the next UTC day if the service hits its own sending budget. The admin view says when email is waiting. Chat and webhook alerts are not the same bucket as email. None of this installs a new certificate. The alert is a reminder that a date in the inventory, or a renewal that is logged and not deployed, needs a person.

A practical order of operations

Look the domain up on the checker and see whether anything expires inside 30 days. If the page is empty, do not treat that as proof that no certificate exists. The source lists unexpired public issuances, one page at a time. Then create an account and add the domain so later pages and later days are stored.

If you need a person to be told, move the organization to Pro for email or to Team for Slack and the other webhooks. Add the host that actually terminates TLS if you also need to know that the newest logged certificate is the one being served. The endpoint page is where that comparison lives. The checker will never grow into that probe by itself.

Questions

Look up a domain or start monitoring

The public checker reads one page of Certificate Transparency and does not connect to the domain. An account keeps the inventory. Alerts, when you want them, start on a paid plan.

Check a certificate Create an account

See pricing for what Free, Pro, and Team include. The mozilla.org demo is logs only and is not affiliated with Mozilla. Related: SSL certificate expiry monitoring · Plans · How alerts are described in the docs.