Monitor SSL Certificate Expiry from Your Mac (2026)
Short version. Certificates expire at the worst possible moment, and "we use auto-renewal" is not the safeguard people think it is. Renewal breaks quietly: a changed DNS record, a firewall rule, an expired API token, a cron job on a decommissioned host. The fix is to watch the live certificate the server is actually serving, not the renewal system. PingKit Agent does that, free for one domain on every device and up to 25 with Guardian Plus.
An expired certificate takes a site down completely, with a full-page browser warning rather than a subtle degradation. It is one of the highest-impact, most preventable outages there is.
Full disclosure: I build PingKit Agent, so weigh the recommendation accordingly. The limits section is not padding, and there is a whole category of Mac network tool below that PingKit deliberately is not.
Why Auto-Renewal Is Not Enough
Let's Encrypt and ACME clients are excellent, and most of the time renewal happens silently and correctly. The failure modes are not in the renewal logic; they are around it:
- The DNS record used for validation changed.
- A firewall rule now blocks the HTTP challenge path.
- The API token for a DNS-01 challenge expired.
- The renewal cron job lives on a host that was rebuilt or decommissioned.
- Renewal succeeded, but nothing reloaded the web server, so the old certificate is still being served.
That last one is the cruellest: the renewal system reports success and the site still breaks. It is also the reason the only measurement that matters is what the server actually presents on the wire.
The Options
1. A one-line check you can schedule
On a Mac, openssl is already installed:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
Free, exact, and scriptable with cron or launchd. You maintain the alerting yourself, and a silently stopped launchd job is the usual way this ends.
2. A monitoring service
Uptime services often include certificate expiry checks, which is sensible if you already use one.
3. An app that keeps the list
PingKit Agent's Cert Monitor holds a list of domains and checks them on a schedule, warning you before expiry. Precise mechanics, because vagueness in this area is exactly what causes the outage:
- One domain free on every device, expiry alerts included. Guardian Plus raises the cap to 25.
- Checked hourly, on a fixed schedule that is not user-configurable.
- Alerts at 30, 14, 7 and 1 days before expiry. A fixed four-stage schedule, not a single adjustable threshold.
- Roughly 30 days of local history.
What It Does Not Check
Being explicit, because certificate tooling varies a lot in scope. Cert Monitor tracks the chain, expiry, subject, SANs and signature algorithm. It does not report the negotiated TLS version or cipher suite, so it will not tell you a server still permits an outdated protocol or a weak cipher. For a full configuration audit, use an online TLS scanner or testssl.sh from a computer.
Check the SANs, not just the date. A certificate can be perfectly valid and still break a subdomain if that name is missing from the Subject Alternative Names. This happens after someone adds a hostname and renews without updating the certificate request, and the date-based alert will never catch it.
Honest Limits
- Hourly checks with a fixed 30/14/7/1 day alert schedule. Neither the interval nor the thresholds are configurable.
- No TLS version or cipher reporting, as above.
- Public hosts. A certificate on an internal-only host is not reachable for checking.
- One domain is free; monitoring more is paid. On the Mac, Guardian Plus is $4.99/month with a one week trial, or $39.99/year with no trial. macOS 15 or later.
Frequently Asked Questions
How do I check when an SSL certificate expires on a Mac?
openssl is already installed. Run: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate. That reports the expiry date of the certificate the server is actually serving.
Why do certificates still expire if auto-renewal is set up?
Renewal usually fails around the edges rather than in the renewal logic: a changed DNS validation record, a firewall rule blocking the challenge, an expired API token, or a cron job on a rebuilt host. The most common is renewal succeeding without the web server reloading, so the old certificate keeps being served.
How far in advance should I be warned about certificate expiry?
Thirty days gives room to investigate a failing renewal without urgency, with closer reminders as a backstop. PingKit Agent's Cert Monitor alerts at 30, 14, 7 and 1 days, which is a fixed schedule rather than an adjustable threshold. One domain is monitored free on every device; Guardian Plus raises the cap to 25.
Can I monitor certificates on an internal server?
Not with a hosted or app-based checker, since the host has to be reachable from where the check runs. For internal hosts, run a scheduled openssl check from a machine inside the network.
Does certificate monitoring check for weak ciphers?
PingKit Agent's Cert Monitor does not. It tracks the chain, expiry, subject, SANs and signature algorithm, and does not report the negotiated TLS version or cipher suite. Use an online TLS scanner or testssl.sh for a configuration audit.
Never be surprised by an expiry again
One domain free on every device, up to 25 with Guardian Plus, checked hourly with warnings at 30, 14, 7 and 1 days. macOS 15 or later.
Get PingKit Agent for Mac