Cert Monitor watches your domains' TLS certificates and pushes a notification 30, 14, 7 and 1 days before each expires, and immediately if the chain stops validating. One domain is free. Guardian Plus watches 25.
Get PingKit Agent for MacOr download PingKit for iPhone
Free to download. One domain is free with push. Guardian Plus is $4.99 a month or $39.99 a year on Mac, $9.99 a month or $79.99 a year on iPhone and iPad. Every plan has a 1-week trial except Mac yearly.
Add a domain, and a port if it is not 443. The Mac Agent checks it every hour; the iPhone checks it each time you open the app. Every check connects over TLS, reads the certificate chain and reports the result to PingKit's backend, which sends a push notification 30, 14, 7 and 1 days before the certificate expires, and immediately if the chain stops validating. If three hours pass with no report for a domain, you are told that too, once, so a sleeping Mac does not become a silent gap in your coverage.
One domain is free, permanently, with the full alert schedule. Guardian Plus raises the limit to 25 and adds the signed compliance PDF.
Four warnings before expiry, spaced so the first arrives while a renewal is still routine and the last while there is still time.
A missing intermediate, an untrusted root or a mismatched name is reported on the next check, not on the next expiry.
Alerts arrive as notifications on your iPhone and in the Mac Agent, which is the whole point now that Let's Encrypt no longer emails expiry warnings.
If three hours pass with no report for a domain, the backend sends one stale-monitor alert rather than leaving you to assume all is well.
The honest version, because it decides which app to put this in. The Mac Agent polls every domain in its list once an hour for as long as the Mac is awake, whether or not the Agent window is open. The iPhone polls when you open PingKit, because iOS does not let an app keep probing in the background, and PingKit does not pretend otherwise. PingKit's backend owns the notifications either way: it compares each report against the thresholds and sends the push. So the Mac is the better home for Cert Monitor, and Guardian Plus is also cheaper there: $4.99 a month against $9.99 on the iPhone.
If you have no Mac, the iPhone still works as a watch list you check into: every open refreshes every domain, and the thresholds are the same. The stale-monitor alert will also arrive once the app has been closed for a few hours, which is the backend telling you truthfully that nothing is checking.
It does not report the negotiated TLS version or cipher suite. Cert Monitor answers one question well: will this certificate still be valid next week, and is the chain intact today. The on-demand SSL Inspector reads the same chain for any host without adding it to a watch list.
| Free | Guardian | Guardian Plus | |
|---|---|---|---|
| Monitored domains | 1 | 1 | 25 |
| Alert schedule | 30, 14, 7, 1 days; chain failure; stale monitor | Same | Same |
| Signed compliance PDF | No | No | Yes |
| Price in the Mac Agent | $0 | $2.99/mo or $24.99/yr | $4.99/mo with a 1-week trial, or $39.99/yr with no trial |
| Price on iPhone and iPad | $0 | $2.99/mo or $24.99/yr | $9.99/mo or $79.99/yr, 1-week trial |
A Plus subscription bought on the iPhone unlocks the Mac Agent through iCloud; one bought inside the Mac Agent covers that Mac only. Guardian on its own does not change Cert Monitor: it is the tier for the Mac Agent on your phone and for Uptime Watch.
Guardian Plus exports a PDF inventory of every monitored domain with the fields above, plus your Uptime Watch targets, citing ISO/IEC 27001:2022 Annex A controls A.5.37, A.8.15 and A.8.8. The file carries its own Ed25519 signature, generated on the exporting device, with the public key printed in the footer of every page; any edit, including re-saving from a viewer, breaks it. It exports from the Mac Agent's Reports pane and from the iPhone. How the inventory replaces the spreadsheet, and which controls it evidences.
Yes. PingKit monitors one domain free of charge, permanently, with push notifications at 30, 14, 7 and 1 days before expiry and immediately on a chain failure. Guardian Plus raises the limit to 25 domains.
For the domains you add, yes, and with a push instead of an email. Let's Encrypt ended its expiration notification emails on June 4, 2025. Cert Monitor's 30, 14, 7 and 1 day alerts cover a 90-day certificate comfortably. For the 6-day certificates Let's Encrypt made generally available in January 2026, the alert that matters is the one at 1 day, which fires only if automated renewal has already failed.
No. iOS does not allow it, so the iPhone checks each time you open the app and the Mac Agent checks every hour. PingKit's backend sends the notifications in both cases. If you want hourly coverage without opening anything, run the Mac Agent.
A sleeping Mac does not poll. If three hours pass with no report for a domain, the backend sends one stale-monitor alert so the gap is visible rather than silent. For continuous coverage keep the Mac awake, or turn off sleep while plugged in under System Settings.
Guardian Plus. It is $4.99 a month or $39.99 a year in the Mac Agent, and $9.99 a month or $79.99 a year on iPhone and iPad. Every Plus plan has a 1-week free trial except the Mac yearly one. A Plus subscription bought on the iPhone unlocks the Mac Agent through iCloud; one bought inside the Mac Agent covers that Mac only.
Get the Mac Agent for hourly checks, or PingKit on iPhone for a watch list you check into. Either way the push arrives before the certificate expires.
Get PingKit Agent on the Mac App StorePingKit for iPhone on the App Store
The Mac Agent requires macOS 15 or later; PingKit for iPhone requires iOS 17.0 or later. All 19 tools free, forever.