CertMonitor 000256.xyz
Free • No login • No cookies

Never let an SSL certificate or domain expire.

Runs a live TLS handshake and an RDAP registry lookup for any hostname and shows when the certificate and the domain registration expire. It also checks Certificate Transparency logs for a renewed certificate the server is not using yet. Free, no login, no cookies.

Quick test:

Many hosts? Check up to 25 at once: one table sorted by soonest expiry, with a CSV download.

google.com

Port 443 VALID (64 DAYS REMAINING) ACTIVE (687 DAYS REMAINING)
Live Handshake Completed at Oct 27, 2026 13:42:44 UTC
Terminal check 
curl -sL "https://000256.xyz/api/check?host=google.com&format=text"
64 Days SSL Remaining
687 Days Domain Remaining
24/7 Certificate & Domain Monitoring for google.com

Checked every 24 hours, and every hour while something is wrong or within 14 days of expiry. Alerts at 30, 14, 7 and 1 days before expiry and when TLS breaks, sent to the Discord, Slack, Microsoft Teams, Google Chat, ntfy, Telegram or HTTPS webhook you enter below before checkout.

or monitor up to 3 hostnames free, same checks ↓

SSL / TLS Certificate

Direct TLS handshake

Certificate Expiry
64 Days

Certificate is valid, trusted, and correctly matches 'google.com'.

1541 Hours Left
Valid Until (Expiry): Dec 30, 2026 19:07 UTC
Issued On (Start): Oct 07, 2026 19:07 UTC
Certificate Lifetime: 83 days
Certificate Authority / Issuer: Google Trust Services
Common Name (CN): *.google.com
Negotiated Protocol: TLSv1.3
Cipher Suite: TLS_AES_256_GCM_SHA384 (256-bit)
Serial Number: E2:A6:92:20:A0:74:04:F5:12:83:53:C5:0F:EF:42:0D
Signature Algorithm: SHA256
Public Key: ECDSA
Subject Alternative Names (SANs): (65 total)
*.google.com *.appengine.google.com *.bdn.dev *.origin-test.bdn.dev *.cloud.google.com *.crowdsource.google.com *.datacompute.google.com *.google.ca +57 more

Domain Registration (RDAP)

Authoritative RDAP registry data

Domain Expiry
687 Days

Domain is registered and active for another 687 days.

16502 Hours Left
Apex Domain: google.com
Registrar Organization: MarkMonitor Inc.
Domain Expiry Date: Sep 14, 2028 04:00 UTC
Registration Created Date: Sep 15, 1997
Registry Status Flags: Client Delete Prohibited, Client Transfer Prohibited, Client Update Prohibited, Server Delete Prohibited
Authoritative Nameservers: ns1.google.com, ns2.google.com, ns3.google.com, ns4.google.com

Certificate Chain (Server → Intermediate → Root)

Full trust path verification. We inspect the certificate hierarchy sent by the server and verify intermediate CA links to a trusted root in the Mozilla root store.

CHAIN VERIFIED

Complete certificate chain: Server certificate correctly links through intermediate CA to a trusted root in the Mozilla / system root store.

Server Certificate

*.google.com

VALID
Common Name (CN): *.google.com
Issued By: Google Trust Services (WE2)
Validity Period: Oct 07, 2026 19:07 UTC to Dec 30, 2026 19:07 UTC (64d left)
Key & Signature: ECDSA (secp256r1) • SHA256
Serial Number: E2:A6:92:20:A0:74:04:F5:12:83:53:C5:0F:EF:42:0D
↓ Issued by: Google Trust Services

Intermediate Certificate

WE2

VALID
Common Name (CN): WE2
Organization: Google Trust Services
Issued By: Google Trust Services LLC (GTS Root R4)
Validity Period: Dec 13, 2023 09:00 UTC to Feb 20, 2029 14:00 UTC (847d left)
Key & Signature: ECDSA (secp256r1) • SHA384
Serial Number: 7F:F3:2D:6B:40:9D:15:D5:96:5B:05:87:3A:7C:72:E0
↓ Issued by: Google Trust Services LLC

Root Certificate (Trusted Anchor)

GTS Root R4

TRUSTED ROOT
Common Name (CN): GTS Root R4
Organization: Google Trust Services LLC
Issued By: Google Trust Services LLC (GTS Root R4)
Validity Period: Jun 22, 2016 00:00 UTC to Jun 22, 2036 00:00 UTC (3525d left)
Key & Signature: ECDSA (secp384r1) • SHA384
Serial Number: 02:03:E5:C0:68:EF:63:1A:9C:72:90:50:52

Certificate Transparency

Every publicly trusted certificate is logged. We compare the newest ones with the certificate this endpoint actually serves.

CHECKING CT LOGS

Looking up Certificate Transparency logs for google.com…

Data sources: the timestamps (SCTs) embedded in the served certificate, checked against the log keys in Chrome's CT log list, and crt.sh, the public Certificate Transparency search run by Sectigo, cached for up to 6 hours.

Renewal Timeline

Each bar shows the time left: the certificate against its full lifetime, the domain registration against one year (a full bar means a year or more).

SSL Certificate Window 64 days remaining of 83d lifetime
Domain Registration Window 687 days remaining
TLS certificate expiry for google.com
Markdown
[![TLS certificate expiry for google.com](https://000256.xyz/api/badge/google.com.svg)](https://000256.xyz/audit/google.com)
HTML
<a href="https://000256.xyz/audit/google.com"><img src="https://000256.xyz/api/badge/google.com.svg" alt="TLS certificate expiry for google.com" height="20"></a>

The badge only shows the date. Alerts before expiry are the €4/month monitoring tier (10 hostnames; 3 can be monitored free).

March 2026 TLS Policy Update: 200-Day Maximum Lifetime

Under the CA/Browser Forum baseline requirements, publicly trusted TLS certificates issued from March 15, 2026 are valid for at most 200 days. The limit drops to 100 days in March 2027 and 47 days in March 2029, so yearly manual renewal no longer works.

24/7 monitoring

Get told before a certificate or domain lapses, or a TLS setup breaks

The check above runs once. Monitoring repeats it for you: each hostname every 24 hours, and every hour while something is wrong or within 14 days of expiry. Free for up to 3 hostnames with one alert destination, no account and no payment.

Certificate and domain expiry

Alerts start 30 days before the certificate or the domain registration expires, whichever is first: a warning at 30 and at 14 days, a critical alert at 7 and at 1 day, each sent once.

Broken TLS, not just expiry

You also get an alert when the TLS handshake fails, the certificate chain is not trusted, or the certificate does not cover the hostname. To avoid alerts for a one-off network blip, the problem must show up on two checks in a row, an hour apart.

Renewed but not deployed

Each check also compares the certificate your server serves with the newest one for the hostname in the Certificate Transparency logs (crt.sh). If a renewed certificate with a later expiry has been logged for more than 24 hours and the server still serves the old one, you get one alert with both expiry dates, once per renewed certificate. This runs once the served certificate is within 30 days of expiry. When crt.sh's answer is missing certificates (the served one's own CT timestamps prove it was logged), the check says so instead of reporting no renewal.

Instant alerts to Discord, Slack, Teams, Google Chat and ntfy

Alerts are webhook POSTs, sent the moment a check finds a problem: ntfy push, Telegram, Discord, Slack, Microsoft Teams, Google Chat or any HTTPS webhook. That is a Discord or Slack channel webhook, a Teams channel's Workflows webhook (the alert arrives as an Adaptive Card), a Google Chat space webhook, or an ntfy topic for phone push with the free ntfy app and no sign-up anywhere. Telegram bots and your own HTTPS endpoint (JSON) work too, all on every plan. Every alert includes days left, expiry dates and the issuer. No SMS.

No account, no password

We send a test alert first and start monitoring only if it arrives. You then get a private manage link where you can add or remove hostnames, run a check now, or stop monitoring, which deletes everything we stored for it.

Free
€0
Up to 3 hostnames, 1 alert destination. Starts now.
Paid
€4/month
Up to 10 hostnames, 1 alert destination (Discord, Slack, Teams, Google Chat, ntfy and more). Billed via Stripe by Mätkyt.fi. Or €39/year.
One per line or separated by commas. Add :port for a non-443 port.
Install the free ntfy app and subscribe to the same topic. Anyone who knows the topic name can read it, so make it hard to guess.

Posts one sample alert with the first hostname's real check results to the URL above and shows the HTTP status it answered. Nothing is stored. Do this before you pay.

Sends one test alert to your destination first.

Payment is processed by Stripe. The seller and card statement show Mätkyt.fi, which operates 000256.xyz.

You pay on Stripe's own checkout page. When the payment goes through, Stripe sends you back here, these hostnames are monitored from that moment and your private manage link opens, where you can cancel any time.

Cancel yourself any time from your manage link: Stripe stops renewing, you are not charged again and monitoring runs to the end of the period you paid for. Refunds: within 14 days of your first payment, ask alludus@hotmail.com and you get all of it back; no refunds for part of a period after that.

CertMonitor and UptimeRobot, side by side

UptimeRobot is the standard website monitor, and its free plan is generous: 50 monitors checked every 5 minutes, covering HTTP(S), port, ping and keyword checks, with alerts to many channels and a mobile app. If you need to know when your site goes down, use it. We do one narrower job: tell you when a TLS certificate or a domain registration is about to run out, right now and without an account.

FeatureCertMonitor (this site)UptimeRobot
One-off check, no account Yes. Type a hostname above and get the certificate and the domain expiry in seconds. Monitoring needs an account. Its free tools include a DNS lookup and calculators, but no instant certificate or domain expiry check.
Uptime monitoring (HTTP, port, ping, keyword) No. We don't check whether your site is up. Yes, free: 50 monitors at a 5-minute interval. Paid plans go down to 60, 30 and 15 seconds.
Certificate expiry alerts Free for 3 hostnames, checked daily and hourly when something is wrong. We also alert on an untrusted chain, a hostname mismatch or a failed handshake. Paid: €4/month for 10 hostnames. On paid plans, from Solo at €108/year for 10 monitors: alerts 30, 14 and 7 days before expiry, and when the certificate has a problem. The Free plan card lists “SSL & Domain exp. monitor” with a red ✕ (not included), and the feature table says “SSL monitoring is included only in paid plans.”
Renewed certificate never deployed Yes, free. We compare the served certificate with the newest one in the CT logs and alert once per renewed certificate that is still not deployed 24 hours after it was logged, with both expiry dates. Its SSL monitoring page describes expiry and error alerts for the certificate the endpoint serves and does not mention Certificate Transparency logs, so a renewal that was issued but never installed shows up only as the old certificate nearing expiry.
Domain registration expiry Yes, free, from the registry's public RDAP record. If a registry hides the date, we say so instead of guessing. On paid plans: alerts 30, 14 and 7 days before the domain expires. Its domain monitoring page says “It’s automatically enabled on paid plans.” Same red ✕ on the Free card.
Certificate details Issuer, SANs, serial, protocol and cipher, plus the newest Certificate Transparency log entries next to the certificate actually served. Expiry and certificate-error alerts on paid plans. Its pricing page lists no tool that shows a certificate’s issuer or SANs.
Alert channels Instant webhook alerts to Discord, Slack, Microsoft Teams, Google Chat, ntfy push, Telegram or any HTTPS endpoint, on every plan including free. No email alerts and no SMS. Free: email, Google Chat, Discord, Pushover, Pushbullet, Splunk and more. Slack, Mattermost, Telegram and Teams from Solo; webhooks, Zapier and PagerDuty from Team. SMS and voice credits are sold separately.
Status pages, teams, API, multi-region checks None. No team accounts, no public status pages, no API, single-region checks. Yes. One basic status page is free; more, plus seats and multi-region checks, on paid plans.
Account, cookies, tracking No account. This page sets no cookies and loads no analytics or third-party scripts. You create an account to make monitors.

Short version: for uptime, use UptimeRobot. For a quick certificate or domain answer, or expiry-only alerts without an account, use this. The two work fine together. UptimeRobot details come from uptimerobot.com/pricing (Free plan card, feature table and FAQ), /domain-expiration-monitoring and /free-tools as of 24 October 2026. Plans change, so check there before you decide. We are not affiliated with UptimeRobot.

Privacy, in plain words

The free check needs no account. This page sets no cookies and loads no analytics, ads or third-party scripts. When you check a hostname, our server connects to that host, asks the domain's registry through rdap.org, and asks crt.sh for its public certificate log, so those services see the hostname coming from our server, never your IP address. Our visit log keeps only the time, route, status, a one-way hash of the hostname and a visitor code re-salted daily (never your IP address or browser details), and deletes it within 30 days. The web server in front of the site keeps its own standard access log (IP address, requested address, browser) for 14 days. If you start monitoring, we store your monitored hostnames, your alert webhook URL (Discord, Slack, Microsoft Teams, Google Chat, ntfy, Telegram or your own HTTPS URL), a SHA-256 hash of your manage token and the latest check results until you remove them or stop monitoring.

✓ No cookies ✓ No account needed ✓ No analytics or ads Full privacy page