Frequently Asked Questions

When you enroll a domain and provide your email, we send a single cryptographic activation link. Once clicked, our automated background scheduler inspects your domain over standard port 443 TLS connections and sends advance warning emails at 30, 14, 7, 3, 1 days before expiration, plus critical alerts on expiration day. Everything is passwordless and 100% free forever.

Notifications are dispatched at 6 standard threshold milestones: 30 days, 14 days, 7 days, 3 days, 1 day, and 0 days (Day of Expiration). Each threshold alert is sent at most once per certificate lifecycle to eliminate email spam.

Our monitoring engine automatically checks the cryptographic SHA-256 fingerprint of your live certificate. When a new certificate fingerprint with an extended expiration date is detected, the alert cycle resets immediately and a renewal confirmation email is dispatched.

Every notification email includes a secure 1-click management link (and an instant unsubscribe link). Clicking your management link opens your personalized dashboard at /manage?token=... where you can view all your monitored domains, pause/resume checks, or purge your email and records completely.

Yes. You can enroll up to 25 active domain names or subdomains per verified email address. All monitored properties appear under your single passwordless management dashboard.

An SSL/TLS certificate is a cryptographically signed public credential issued by a trusted Certificate Authority (CA) that binds your domain name to an asymmetric cryptographic key pair. Expiration dates are mandated by the CA/Browser Forum to mitigate the risk of compromised private keys, ensure domain ownership is periodically re-verified, and rapidly phase out outdated encryption ciphers.

Major browser vendors (Google, Apple, Mozilla) have shortened maximum certificate validity from 5 years down to 398 days, with Let's Encrypt standardizing on 90 days. Google Chrome's "Moving Forward, Together" proposal targets a 45-day maximum lifespan to eliminate reliance on slow, privacy-leaking revocation checks (OCSP/CRLs) and force reliable automated ACME certificate management.

The Common Name (CN) is a legacy X.509 attribute that supported only a single hostname. Modern browsers completely ignore the CN and strictly require the Subject Alternative Names (SANs) extension. A SAN certificate can secure multiple discrete domains (e.g. example.com, www.example.com, api.example.com) or wildcards (*.example.com) under a single cryptographic envelope.

A wildcard certificate (*.example.com) protects all first-level subdomains (such as app.example.com, api.example.com, blog.example.com). However, per RFC 6125, a wildcard does NOT protect the bare apex domain (example.com) unless explicitly listed in SANs, nor does it cover multi-level subdomains (e.g. sub.app.example.com).

When a certificate expires, web browsers immediately block visitors with full-screen security warnings (such as NET::ERR_CERT_DATE_INVALID or SEC_ERROR_EXPIRED_CERTIFICATE). Mobile applications and REST/GraphQL APIs fail HTTPS handshakes, preventing data transmission and causing severe brand and revenue loss.

The 4 most common silent ACME renewal failures are: (1) Security groups blocking HTTP-01 validation on port 80; (2) Web server not reloaded after renewal (missing --deploy-hook "systemctl reload nginx"); (3) DNS-01 API credentials expiring; and (4) Let's Encrypt rate limits during CI/CD redeployments. External monitoring acts as a safety net when internal scripts fail.

On your Linux web server, execute "sudo certbot renew --force-renewal" and then reload your web server via "sudo systemctl reload nginx" (or apache2). If the certificate on disk is already updated, restarting/reloading the web server forces Nginx to flush its in-memory SSL cache.

Cloudflare Error 525 (SSL Handshake Failed) means Cloudflare's edge server could not complete a TLS handshake with your origin server on port 443. Error 526 (Invalid SSL Certificate) occurs in Full (Strict) mode when your origin server presents an expired, self-signed, or hostname-mismatched certificate.

No, never. CheckSSLExpiry performs standard public TLS socket handshakes on port 443 — the exact same handshake web browsers perform when loading a webpage. We never request, access, or store private keys, SSH credentials, or server files.

All tokens are 256-bit cryptographically secure random values (crypto.getRandomValues). Raw tokens are never stored on our servers; only their irreversible SHA-256 cryptographic hashes are stored in the database.

We only store the target domain name, your verified email address, public certificate metadata (fingerprint, expiration date), and notification state counters. We never sell or share user data. Deleting your monitor immediately purges your email and records permanently.