Let's Encrypt ended its expiration notification emails on 4 June 2025, so a silent renewal failure no longer produces a warning in your inbox. Monitor expiry yourself by probing the live endpoint and alerting when the served certificate has fewer days left than your renewal window plus a safety margin.
What changed and why
In January 2025 Let's Encrypt announced it would stop sending expiry emails on 4 June 2025. It gave three reasons: automation is now reliable for most subscribers, keeping millions of email addresses tied to issuance records conflicts with its privacy goals, and the service had a cost and complexity burden. It pointed people who still want notifications to third party monitoring services.
If your only safety net was that email, you now have none. This matters most for older servers where renewal was set up years ago and nobody has looked since.
What to monitor
Alert on what users actually receive, not on what your client thinks it did. A renewal job can report success while the web server keeps serving the old certificate from memory.
| Check | What it catches |
|---|---|
| Days remaining on the served certificate | Failed renewal, or a server that never reloaded |
| Renewal job exit status and last success time | A cron or timer that stopped running |
| Certificate Transparency entries for your names | Unexpected issuance, and hostnames you forgot |
| Chain validity from an outside vantage point | A broken intermediate or a missing chain |
A simple threshold rule
Pick the alert threshold from your renewal setting. Let's Encrypt's integration guide suggests renewing when a certificate has a third of its lifetime left, which is 30 days before expiry for a 90 day certificate. If your client renews at 30 days, alerting at 14 days gives you a full two weeks to fix a stuck renewal. Page someone at 7 days.
For very short certificates the same logic shrinks. The guide suggests renewing halfway through the lifetime for certificates under 10 days, so a six day certificate needs alerting measured in hours, not days.
Steps to set it up
- List every hostname you serve, including internal ones that use public certificates. Certificate Transparency search can help find forgotten names.
- Probe each name over TLS from outside your network at least daily. Read the expiry date from the handshake.
- Alert at two levels: a warning with plenty of time, and a page when a human must act.
- Alert separately if a renewal job has not succeeded within its expected interval.
- Test the alert once by pointing the probe at a test endpoint with a short-lived certificate.
An exit-code check is the lightest option for a single host. See the cron approach in checking expiry with openssl.
Where Safeguard fits
Safeguard does not monitor certificate expiry. It covers the software side: SBOM and dependency scanning for the TLS libraries in your services, plus policies that gate risky changes. A free scan is available at gold.safeguard.sh/scan.
Quick check
When exactly did Let's Encrypt stop the emails?
The announcement set 4 June 2025 as the end date for expiration notification emails.
Should I still give Let's Encrypt an email address?
You can. The announcement says subscribers can opt in to other emails such as technical updates, but expiry reminders are gone.
Is monitoring needed if renewal is automated?
Yes. Automation fails quietly when a timer stops, a hook breaks or a server does not reload. Monitoring the served certificate is the check that matches user experience.
Sources
Last reviewed: 19 October 2026.
