Monitor SSL Certificate Expiry and Alert Early

Schedule

Setup

1. 1

   Install dependencies

   The script uses openssl and curl, which are available on virtually all Linux distributions. Verify with: openssl version && curl --version. No additional packages are needed.

2. 2

   Create the script file

   Save the script below to a file on your server, for example /usr/local/bin/check-ssl-expiry.sh, then make it executable with: chmod +x /usr/local/bin/check-ssl-expiry.sh

3. 3

   Set your variables

   Edit the top of the script and set DOMAIN to the hostname you want to check (e.g. example.com), WARN_DAYS to the number of days before expiry you want to be alerted (30 is a safe default), and ALERT_EMAIL to the address that should receive warnings.

4. 4

   Add the cron entry

   Run crontab -e and add the line shown below. The schedule runs the check every day at 8 AM. Example: 0 8 * * * /usr/local/bin/check-ssl-expiry.sh >> /var/log/check-ssl-expiry.log 2>&1

5. 5

   Create a CronJobPro heartbeat and add the ping URL

   In CronJobPro, create a new Heartbeat monitor with a period of 25 hours and a grace period of 2 hours. Copy the generated ping URL (https://cronjobpro.com/ping/<token>) and paste it into the HEARTBEAT_URL variable at the top of the script. From this point on, CronJobPro will alert you if the check stops running for any reason.

The script

bash

#!/usr/bin/env bash
set -euo pipefail

# --- Configuration ---
DOMAIN="example.com"
PORT="443"
WARN_DAYS=30
ALERT_EMAIL="you@example.com"
HEARTBEAT_URL="https://cronjobpro.com/ping/YOUR_TOKEN_HERE"
# ---------------------

check_cert_expiry() {
  local domain="$1"
  local port="$2"

  # Fetch the certificate expiry date from the live TLS handshake
  local expiry_date
  expiry_date=$(
    echo | openssl s_client -servername "$domain" -connect "${domain}:${port}" 2>/dev/null \
      | openssl x509 -noout -enddate 2>/dev/null \
      | cut -d= -f2
  )

  if [[ -z "$expiry_date" ]]; then
    echo "ERROR: Could not retrieve certificate for ${domain}:${port}" >&2
    curl -fsS --retry 3 "${HEARTBEAT_URL}/fail" > /dev/null 2>&1 || true
    exit 1
  fi

  # Convert expiry date to epoch seconds (works on Linux with GNU date)
  local expiry_epoch
  expiry_epoch=$(date -d "$expiry_date" +%s)

  local now_epoch
  now_epoch=$(date +%s)

  local seconds_remaining=$(( expiry_epoch - now_epoch ))
  local days_remaining=$(( seconds_remaining / 86400 ))

  echo "Certificate for ${domain} expires in ${days_remaining} day(s) (on ${expiry_date})"

  if (( days_remaining <= 0 )); then
    local subject="CRITICAL: SSL certificate for ${domain} has EXPIRED"
    local body="The SSL certificate for ${domain} expired on ${expiry_date}. Renew immediately."
    echo "$body" | mail -s "$subject" "$ALERT_EMAIL"
    echo "ALERT sent: certificate expired."
    curl -fsS --retry 3 "${HEARTBEAT_URL}/fail" > /dev/null 2>&1 || true
    exit 2
  elif (( days_remaining <= WARN_DAYS )); then
    local subject="WARNING: SSL certificate for ${domain} expires in ${days_remaining} day(s)"
    local body="The SSL certificate for ${domain} will expire on ${expiry_date} (${days_remaining} days remaining). Please renew it soon."
    echo "$body" | mail -s "$subject" "$ALERT_EMAIL"
    echo "ALERT sent: ${days_remaining} days remaining."
  else
    echo "OK: certificate is valid for ${days_remaining} more day(s). No alert needed."
  fi
}

check_cert_expiry "$DOMAIN" "$PORT"

# Ping the heartbeat to confirm the check completed successfully.
# CronJobPro will alert you if this ping stops arriving.
curl -fsS --retry 3 "$HEARTBEAT_URL" > /dev/null 2>&1 || true

exit 0

Frequently asked questions

More recipes