SSL expiry check
Inspects live TLS certificates over node:tls — no agent on the target host, no DNS gymnastics. Captures issuer, chain, validity window and SANs.
Open-core · Self-hosted · AGPL v3
Self-hosted SSL certificate monitor.
Docker one-liner. 5 alert channels. Zero external dependencies.
SSLert watches your TLS certificates and domain registrations, alerting you 30, 7 and 1 days before they expire — across email, webhook, Telegram, Slack and ntfy.
- 5alert channels
- 0external services
- 30 / 7 / 1day warnings
- AGPL v3truly open source
Let's Encrypt killed expiry emails. You're flying blind.
On June 4, 2025 Let's Encrypt shut down their certificate-expiration notification emails — the same emails tens of thousands of operators relied on as their first line of defense against an outage.
And it's only going to get worse. The CA/Browser Forum has approved a roadmap that shrinks public TLS certificate lifetimes to 47 days by 2029, with intermediate steps at 200, 100 and now 90 days already in motion. Shorter lifetimes mean more frequent renewals, more chance of a mistake, and more chance of a silent expiry.
SSLert is the lightweight, self-hosted replacement. Drop it on any box with Docker and it watches every certificate and domain registration you point it at — quietly, on a cron, with the alerts going wherever you already read messages.
Everything you need, nothing you don't
Six core capabilities, all open source, all in one binary.
Domain expiry (RDAP & WHOIS)
Tracks domain registration expiry via RDAP bootstrap, with a TCP-WHOIS fallback for TLDs that don't speak RDAP. Same 30/7/1 day alert schedule as SSL.
5 alert channels
Email, generic webhook, Telegram, Slack and ntfy. Per-domain channel config — turn off the noisy ones, keep the ones you actually read.
Real-time dashboard
React 19 + TanStack Query give you live status, expiry counts and per-domain history. Add a domain and the first check fires immediately.
Docker one-liner deploy
Single docker compose up --build. Web on :5173, API on :3000, SQLite in a named volume. Update with git pull && docker compose up -d.
SQLite — no Postgres, no Redis
Data lives in a single SQLite file. cp the file to back up. scp it to migrate. No DB server, no cache, no ops burden.
Up and running in 60 seconds
Clone, configure, deploy. No cloud account, no signup, no SaaS lock-in.
-
1
Clone & configure
git clone https://github.com/einperegrin/sslert.git cd sslert cp .env.example .env -
2
Set alert target (optional)
# .env — leave blank to log alerts to stdout RESEND_API_KEY=re_xxx # https://resend.com (free 100/day) ALERT_EMAIL_TO=alerts@example.com # Or set TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID # Or set SLACK_WEBHOOK_URL # Or set NTFY_TOPIC=my-sslert -
3
Start the stack
docker compose up --buildDashboard at
http://localhost:5173· API athttp://localhost:3000
How SSLert compares
The only open-core, self-hosted option with five real alert channels.
| SSLert | UptimeRobot | Certimon | TrackSSL | |
|---|---|---|---|---|
| Pricing | Free, self-hosted | Freemium, SaaS | Free, hosted | $17 / mo, SaaS |
| Self-hosted | Yes | No | No | No |
| Open source | AGPL v3 | Closed | Closed | Closed |
| Alert channels | 5 (email, webhook, Telegram, Slack, ntfy) | 12+ (paid only) | 3 (Telegram, Teams, PagerDuty) | 3 (email, Slack, Teams) |
| Domain expiry | RDAP + WHOIS | No | No | No |
| Database | SQLite file | Vendor | Vendor | Vendor |
| Docker one-liner | Yes | No | No | No |
Truly open source. Built in public.
SSLert is licensed under the AGPL v3 — the same license used by Nextcloud, Mastodon and Bitwarden. You can read every line, run it forever, and ship modifications internally without permission. The AGPL only kicks in if you offer SSLert itself as a hosted service to others.
The roadmap is on GitHub. Issues and PRs are public. New alert channels, CT-log monitoring and internal/PKI certificate support are all queued up — and we want your input on which to prioritise next.