An expired certificate means a full-page browser warning, broken APIs and lost traffic. Check any domain below for free — then let DeskUptime watch it daily and alert you before it happens.
Check a domain now See DeskUptime →Enter any public URL. We read the certificate's not-after date straight from the TLS handshake.
Prefer the terminal? Run the same check yourself:
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \ | openssl x509 -noout -enddate
Auto-renewal solved most of this — until it quietly stops working.
DNS changes, moved servers and broken ACME challenges all fail without an error you'll see. You find out from a visitor — or a browser warning.
Let's Encrypt certs last 90 days and the industry is moving shorter still. More renewals per year means more chances for one to fail.
On small teams, "someone renews the cert" is everyone's job — so it's nobody's. A monitor makes the deadline visible.
Checking today tells you nothing about the day your renewal fails three weeks from now.
| Manual check | Cron script | DeskUptime | |
|---|---|---|---|
| Runs automatically | ✗ | ✓ (if you maintain it) | ✓ |
| Alerts before expiry | ✗ | You build it | ✓ built-in thresholds |
| Uptime & content-change checks too | ✗ | You build it | ✓ included |
| Server to maintain | — | Required | None — runs on your machine |
| Monthly cost | Your time | ~$5 server | $0 after $19 one-time |
DeskUptime is a desktop app: your URLs are checked from your own machine and never touch our servers. One-time $19, no subscription.
Use the checker above, or run openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate. DeskUptime automates exactly that check on a schedule and alerts you ahead of time.
Yes — that's the trap. Let's Encrypt renewals break silently when DNS changes, the ACME challenge can't complete, or a deploy reconfigures the server. Everything looks fine until the cert runs out.
Two to four weeks is comfortable: enough to fix a broken renewal flow, wait out registrar delays, or escalate to whoever controls DNS. DeskUptime lets you set the threshold.
Yes. TLS certificate checks are platform-independent — WordPress, Shopify, Webflow, Squarespace, static hosts and API endpoints all behave identically. No agent or plugin is installed anywhere.
The web checker only reaches public URLs. The DeskUptime desktop app and CLI check anything your machine can reach — staging domains, intranet hosts, localhost services.