SSL & Domain Expiry Monitor (Watchlist and Calendar Reminders)
Every certificate and domain you look after, sorted by days left — with reminders.
Try before you buy.
- Free preview: the summary counts of every host, with the first half of the watchlist (up to 10 hosts) and their expiry details; a single host is shown with its results hidden.
- Locked until you unlock it: download and copy.
- Unlock: Premium pass, ₹799 for 30 days, a one-time payment that never renews. Batch runs unlock with a pass only.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Add hosts to your watchlist
Your watchlist
Saved in this browser only. Press Check all to refresh the dates.
- 0Failing or expired
- 0Within 7 days
- 0Within 30 days
- 0More than 30 days
- 0Incomplete
Calendar reminders
With a Premium pass, download an .ics file and import it into your calendar app (Apple Calendar, Google Calendar, Outlook and others read it): every known expiry becomes an all-day event with reminders before it. No e-mail and no account — with the pass, download a new file after renewals or when you add hosts.
Some calendar apps do not take over the alerts in an imported file; separate entries still show on each reminder day.
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the SSL & Domain Expiry Monitor (Watchlist and Calendar Reminders)
Keep every certificate and domain you are responsible for in one watchlist, sorted by the days left. Check all reads three things for each host: the most recent certificate in the public Certificate Transparency logs (its expiry date and issuer), whether HTTPS works right now with full certificate validation (through MySmartCoPilot’s server), and the registry’s RDAP record of the domain (its expiry date, registrar and status codes).
The watchlist stays in this browser. With a Premium pass, export it as a CSV for a spreadsheet or a ticket, or download a calendar file (.ics) with an event on each expiry date and reminders 30, 14, 7 and 1 days before, so the alerts come from your own calendar app — no account, no e-mail and no monitoring server.
How to use it
- Paste the host names you look after —
example.com,shop.example.com, a URL or an e-mail address — one per line, choose what to watch, and press Add and check. A table with a host or domain column, such as this tool’s own CSV export, works too: only that column is read. - Wait while the checks run. Certificate searches go to crt.sh one host at a time and can take up to a minute each; registry records and HTTPS checks run alongside, and the list fills in as answers arrive.
- Read the dashboard from the top: hosts whose HTTPS fails, or whose certificate or domain has expired, come first, then those with the fewest days left. Full SSL report and WHOIS details open the single-host tools with that host filled in.
- With a Premium pass, press Download calendar (.ics) and import the file into your calendar app, and download a new file after a renewal or when you add hosts.
- Come back and press Check all before a reminder date, or, with the pass, Download CSV to keep a record of the status.
Examples
shop.example.com
Certificate: Expires in 53 days · 27 Nov 2026 · Let’s Encrypt · R11 · HTTPS now: valid Domain · example.com: Expires in 698 days · 2 Sep 2028 · Example Registrar, Inc.
Certbot renews a certificate once less than a third of its lifetime is left (Certbot documentation) — about 30 days before a 90-day certificate expires. Clearly fewer days left than that usually means automatic renewal has stopped working.
portal.example.org
HTTPS fails now — Certificate rejected (error 526): it has expired, was issued for another name, is self-signed or is not trusted. The most recent certificate in the logs has 85 days left, so the server may be using another (older) certificate.
The certificate authority logged a new certificate, but the web server still presents the old, expired one. Install the new certificate and reload the server.
SUMMARY:SSL certificate expires: shop.example.com DTSTART;VALUE=DATE:20261127 BEGIN:VALARM DESCRIPTION:SSL certificate for shop.example.com expires in 30 days TRIGGER:-P29DT15H END:VALARM
An all-day event on the expiry date; the trigger fires at 09:00 thirty days before it. With “separate calendar entries” the reminder days also get entries of their own.
Common uses
- Agencies and freelancers keeping track of the certificates and domain renewals of every client site.
- IT and web teams catching a failed automatic renewal before visitors see a certificate warning.
- Owners of several domains getting reminders in their calendar before a registration lapses.
- Preparing a renewal schedule, an audit list or a handover document as a CSV.
How each check works
- HTTPS now: MySmartCoPilot’s server — the same guarded check as the SSL Certificate Checker — connects to
https://host/with full (strict) certificate validation, so an expired, wrong-name, self-signed or untrusted certificate fails, and so does a failed TLS handshake. - Certificate expiry and issuer: web pages and serverless functions cannot read the certificate a server presents, so your browser searches the public Certificate Transparency logs (RFC 6962) on crt.sh. Chrome and Safari only trust certificates that have been logged, so every renewal of a publicly trusted certificate shows up there. The monitor takes the most recently issued unexpired certificate that covers the host — by its exact name, or a wildcard such as
*.example.com— and ignores certificates that run longer than any publicly trusted certificate may (test and private authorities). - Domain expiry and registrar: the registry’s RDAP record (RFC 9083), found through IANA’s bootstrap files (RFC 9224) exactly as the WHOIS Lookup does. Subdomains are reduced to the registered domain, and each domain is read once even when several hosts share it.
Certificate searches run one at a time, registry lookups at most two at a time per registry, and HTTPS checks are paced to the server’s per-minute limit, so a long watchlist never floods any of these services.
Reminders and the calendar file
The .ics file follows the iCalendar standard (RFC 5545), which Apple Calendar, Google Calendar, Outlook and most other calendar apps import. Each known expiry becomes an all-day event on the expiry date in your time zone, with:
- alerts (VALARM) at 09:00 on each reminder day you choose — 30, 14, 7 and 1 days before by default;
- separate entries on those days, for calendar apps that do not take over alerts from imported files.
Every event keeps the same identifier (UID) for the same host, and a newer expiry date gives it a higher SEQUENCE number, so calendar apps that match identifiers update the events when you import a newer file. Others add new events: delete the old ones after a renewal. Reminder days that have already passed are left out of the file.
Why expiry dates need watching
The CA/Browser Forum’s Baseline Requirements are cutting the maximum lifetime of publicly trusted TLS certificates in steps, down to 47 days in the end (ballot SC-081). Certificates then renew several times a year, which only works when renewal is automatic — and automatic renewal can stop silently after a DNS, hosting or account change. A certificate whose days left fall well below a third of its lifetime is the early warning.
Domains rarely renew that often, but a lapsed registration takes down the website and the e-mail at once. After expiry, many registries keep a grace period before they delete a domain; how long it lasts is set by each registry, so renew before the date rather than relying on it.
Limitations
- A web page or a serverless function cannot read the certificate a server presents, so the certificate expiry shown is that of the most recently issued certificate for the name in Certificate Transparency logs. When a renewed certificate was issued but not installed, the logs already show the new date — the HTTPS check and the note about an older certificate are there to catch that.
- crt.sh is a public community service that is often slow (up to a minute per host) and sometimes unavailable. A certificate search that fails keeps the last known result and says so; after several failures in a row the remaining searches are skipped.
- The HTTPS check runs on MySmartCoPilot’s server, which allows a limited number of checks per hour; when that limit is reached, the remaining hosts are not checked and the page says when to try again. You can switch the HTTPS check off and still read the logs and registry records; hosts checked that way show no HTTPS result, because an older one would no longer be current.
- Registries that refuse browser requests (.de, for example) are read through MySmartCoPilot’s server, which allows a limited number of such lookups per hour; when the limit is reached, the remaining ones are skipped and the page says when to try again.
- Some country-code registries do not publish an expiry date in RDAP, and some have no RDAP service at all; the domain column then says so.
- Nothing runs in the background: the dates are as current as the last time you pressed Check all on this device. The watchlist exists only in this browser — clearing the site’s data deletes it, so keep the CSV as a backup (with a pass) or a copy of your host names.
- Up to 100 hosts per watchlist.
Privacy
Your watchlist and its last results are stored in this browser only and never uploaded. During a check, host names are sent to MySmartCoPilot’s server for the HTTPS check (it requests https:// and http:// on each host as MySmartCoPilotBot, without cookies, and asks hstspreload.org about it); your browser searches crt.sh for each host name and asks IANA and the registries’ RDAP servers about each domain, without cookies. Registries that refuse browser requests are asked through MySmartCoPilot’s server. MySmartCoPilot does not store host names or results; its log records only the host, status code and time of each server request.
Frequently asked questions
What do I get without a pass?
Without a pass, SSL & Domain Expiry Monitor (Watchlist and Calendar Reminders) shows the summary counts of every host, with the first half of the watchlist (up to 10 hosts) and their expiry details; a single host is shown with its results hidden. Until you unlock it, the result can’t be downloaded or copied. A Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
How is this different from the SSL Certificate Checker?
The SSL Certificate Checker examines one host in depth: redirects, HSTS, the preload list, mixed content and every certificate in the logs. The monitor keeps a list of many hosts and their domains, sorts them by the days left, and turns the dates into calendar reminders. Use Full SSL report on a row to open the checker for that host.
Will I get an e-mail before something expires?
No. Nothing is watched on a server and nothing is sent to you: the alerts come from the calendar file (with a Premium pass) that you import into your own calendar app. Re-run Check all now and then, and with the pass download a new calendar file after renewals.
Why does the expiry date differ from the one my browser shows?
The monitor reads the most recently issued certificate for the name from Certificate Transparency logs. Your browser shows the certificate the server actually presents — usually the same one, but sites behind a CDN often have two valid certificates from different authorities, and a server can still present an older certificate after a renewal. If HTTPS fails while the logs show a new certificate, the new one has probably not been installed.
Why is there no expiry date for my domain?
Some country-code registries do not publish an expiry date in their RDAP records, and some top-level domains — .co and .eu, for example — have no RDAP service listed by IANA, so the date cannot be read from a web page. Your registrar’s control panel always shows it.
Where is my watchlist kept, and can I move it to another device?
In this browser’s storage on this device; it is never uploaded. To use it elsewhere with a pass, open the CSV export, copy everything and paste it into Add hosts on the other device: only its host column is read. Without a pass, paste the host names you entered there. Then choose what to watch and press Add and check.
What happens to old reminders after I renew?
With a pass, download a new calendar file and import it. Events keep the same identifier for the same host, so calendar apps that match identifiers move them to the new date; in apps that do not, delete the old events.
Why is the HTTPS check limited?
Each HTTPS check makes MySmartCoPilot’s server connect to the site, and the server has to stay within its hosting’s daily allowances, so checks are limited per hour and paced per minute. Long watchlists are checked a few hosts at a time; when the hourly limit is reached, the page says when the remaining hosts can be checked.