Getting started

Create a free account — no card required. Your free trial covers 5 domains / certificates, which is enough to try the whole flow: add domains, watch them get checked, see what an alert looks like.

Once you're ready to monitor more than one certificate, see Plans & billing below.

Adding a public domain

From your dashboard, type a hostname into the "example.com" field and click Add domain. Just the domain — no https://, no trailing slash.

• We immediately do a real TLS handshake against it, the same way a visitor's browser would, and show you the issuer, validity dates, and days remaining.
• After that, it's checked automatically once a day.
• You can trigger an extra check anytime with the Re-check button on that row.

If a domain uses a non-standard HTTPS port, that's supported too — just make sure it's reachable from the internet, since this is a live connection, not a local scan.

Adding an internal certificate

Some certificates aren't reachable from the public internet at all — an internal CA's root cert, something behind a VPN, an air-gapped service. For those, click + Add internal certificate (paste PEM) instead.

• Paste the full certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
• Give it a clear name — since there's no hostname to identify it by, the name is how you'll recognize it in your list later. Something like "Prod Internal Root CA" or "VPN Gateway Cert" works well.
• We read the certificate's own validity dates directly — no network connection is made, so this works even for certificates with no public DNS record at all.
• Which group should you choose? Same guidance as below — if you're not sure yet, leave it in General. If this cert belongs to a specific client or environment you already track separately, put it in that group instead.

One honest limitation: because there's no live handshake for internal certs, we can only track the certificate's expiry date — not whether it's been revoked or whether the chain is still trusted.

Certificate Generator

SSL Alerts provides a built-in cryptographic engine to generate production-ready SSL/TLS certificates and signing requests right from your browser or API without installing external command-line agents.

1. Free Let's Encrypt Certificates (DNS-01 ACME)

Issue globally trusted, publicly valid 90-day certificates from Let's Encrypt using automated DNS verification:

• DNS-01 Challenge: Enter your domain name and start the order. SSL Alerts generates the ACME challenge and gives you the exact _acme-challenge TXT record name and value to publish in your DNS registrar (Cloudflare, Route53, Namecheap, GoDaddy, etc.).
• Instant Issuance: Once published, click Verify & Issue. The ACME client verifies challenge propagation, finalizes the order, and outputs your complete certificate bundle (cert.pem, privkey.pem, chain.pem, and fullchain.pem).

2. Self-Signed PKI & Internal Root CA

Need HTTPS for internal microservices, private IP addresses, Docker containers, Kubernetes ingresses, or staging servers?

• Generates a dedicated custom Internal Root Certificate Authority (ca.crt / ca.key) alongside the leaf server certificate (.crt and .key).
• Configurable validity period (from 30 up to 825+ days) and RSA key sizes (2048 or 4096-bit).
• Includes ready-to-use Nginx and Apache configuration snippets to deploy HTTPS in seconds.
• Once you install ca.crt into your OS or team browser trusted roots, green padlock HTTPS works seamlessly across all your internal infrastructure with zero browser warnings.

3. CSR & Private Key Generator

Generate cryptographic Certificate Signing Requests (CSRs) and matching RSA private keys when purchasing SSL certificates from commercial vendors like DigiCert, Sectigo, or GlobalSign:

• Supports Common Name (domain), Organization, Organizational Unit, City, State, Country, and Email fields.
• Outputs standard PEM-encoded PKCS#10 CSR and PKCS#8 private key ready for CA submission.

🛡️ Lifetime Retention & Zero-Trace Auto-Purge

All generated certificates and CSRs are stored in your personal account under Download Certificates:

• Let's Encrypt & Self-Signed Certificates: Safely stored until their cryptographic expiry date (validTo), enabling you to re-download the bundles whenever needed. The moment a certificate expires, our background scheduler permanently deletes it from the database for zero-trace security and privacy.
• CSRs: Maintained for exactly 1 full year so you can easily reuse the CSR and key during annual certificate renewals before automatic deletion.

SSL Diagnostic Tools

A suite of developer and sysadmin utilities to inspect, convert, and repair SSL/TLS configurations:

1. SSL Certificate Health Checker

Performs a live TLS handshake or parses pasted PEM certificates to detect configuration errors before browsers do:

• Inspects Common Name, Subject Alternative Names (SANs), signature algorithms, and key sizes.
• Audits validity windows, days remaining, and issuer hierarchies.
• Identifies vulnerabilities, broken chains, self-signed warnings, and mismatched hostnames.

2. CSR Decoder

Decode and inspect any CSR file before submitting it to a Certificate Authority to ensure subject DN attributes, key strength, and domain spellings are 100% accurate.

3. SSL Certificate Format Converter

Seamlessly convert certificates and private keys between server formats without running OpenSSL commands in your terminal:

• PEM (.crt, .pem): Standard base64 ASCII format used by Apache, Nginx, HAProxy, and Linux servers.
• DER (.der, .cer): Binary format commonly required by Java platforms and specific networking appliances.
• PKCS#12 (.pfx, .p12): Password-protected archive format combining certificate, private key, and intermediate chain for Microsoft IIS, Windows Server, and Tomcat.

4. Certificate Chain & Root CA Resolver

Diagnose incomplete certificate chains. The resolver inspects Authority Information Access (AIA) issuer extension URLs, fetches missing intermediate certificates, and constructs the complete chain back to trusted public root authorities.

Groups — creating & choosing

Groups let you organize certificates by client, environment, or team — useful once your list grows past a handful of entries.

• Every account starts with one group called General. Anything you add without picking a different group lands here.
• To create a new group, use the group dropdown next to the add-domain field — pick a certificate's group at the same time you add it.
• The dropdown at the top of your domain list also filters what you're looking at — pick a group to see only its certificates, or All to see everything.

Which group should you choose when adding a certificate? A simple rule that works for most people:

• Just starting out, or only have a few certs? Leave everything in General — there's no benefit to extra groups yet.
• Managing certs for multiple clients? One group per client, so each client's status is easy to check at a glance.
• Running multiple environments? Groups like Production and Staging keep the ones that actually matter for uptime separate from the ones that don't.

Filtering your list

The four stat cards at the top of your dashboard — Monitored, Healthy, Expiring soon, Critical / expired — are clickable. Click one to filter your list down to just that status; click it again (or Monitored) to clear the filter.

Understanding statuses

• Valid — more than 30 days left. Nothing to do.
• Warning — 30 days or fewer left. Time to plan a renewal.
• Critical — 7 days or fewer left. Renew this soon.
• Expired — already past its expiry date. Anything relying on it is likely broken right now.
• Error — we couldn't verify the certificate at all (connection failed, or it's not trusted). Worth checking manually.

Alerts & acknowledging

The moment a certificate enters Warning, Critical, or Expired, you get an email immediately. If it's still unresolved, you'll get another email every 30 minutes — deliberately persistent, so it can't quietly get lost in an inbox.

• Click Acknowledge on that certificate's row to pause the repeats while you deal with it.
• Click Acknowledge on that certificate's row (or tap Acknowledge & Snooze directly inside the alert email) to pause repeat reminders without logging in.
• Auto-Snooze Protection: If an alert triggers 5 consecutive times without acknowledgment, notifications automatically throttle back to every 4 hours to protect your inbox.
• Warning vs Critical: Certificates in Warning (8–30 days) receive a calm daily reminder (every 24h). Critical certificates (<7 days) trigger at your plan's rapid alert interval.
• Internal Certificate Updates: If an internal certificate is renewed, click Update Cert on its row to paste the new PEM and refresh its validity dates immediately.
• If the status gets worse (Warning → Critical) or changes again after being acknowledged, alerts automatically resume — so acknowledging one problem can never accidentally silence a different, future one.

Plans & billing

• Free Trial (30 Days) ($0) — 5 domains / certificates, 1 alert recipient, 3-hour expiry alert intervals, 30 days access.
• Micro ($2/month — Limited Time Offer, Reg. $4) — 5 domains / certificates, 1 alert recipient, 3-hour expiry alert intervals.
• Starter ($5/month — Limited Time Offer, Reg. $10) — 20 domains / certificates, up to 3 alert recipients, 2-hour critical alert intervals.
• Growth ($10/month) — 50 domains / certificates, up to 5 alert recipients, 1-hour critical alert intervals.
• Pro ($20/month) — 100 domains / certificates, up to 10 alert recipients, 30-min critical alert intervals.
• Agency ($50/month) — 500 domains / certificates, up to 25 alert recipients, 10-min critical alert intervals.
• Enterprise Plan (>500 domains) — Custom quotas, dedicated checking workers, 24/7 SLA, and invoice billing. Contact [email protected].

Public domains and internal certificates count the same toward your plan's limit. Checkout is handled securely through Dodo Payments (supporting international credit/debit cards, Google Pay, Apple Pay, and local currencies).

Instant Upgrades

Upgrading your tier is immediate from the Upgrade plan modal. Your higher domain allowance and shorter alert intervals apply instantly, and our system automatically cancels your prior lower subscription so you are never charged twice.

Self-Service Downgrades & Quota Protection

Need to scale down? You can switch to any lower paid tier directly from the plan modal. To protect your monitoring setup, the system automatically checks that your currently active domains fit within the lower tier's limit before proceeding. Once confirmed, your prior subscription is cancelled automatically.

Pausing & Cancellation

You can cancel or pause your subscription at any time by emailing us at [email protected], or directly via the Manage Subscription link inside your monthly Dodo Payments receipt email. When cancelled, your access remains active until the end of your prepaid billing period, and no further charges occur.

Your account

From the Account page in your dashboard sidebar, you can:

• Update Display Name: Change how your name appears across the app and on notifications.
• Update Primary Email with OTP: Change your account email address securely using 6-digit email verification codes.
• Change Password: Update your account password anytime.
• View Current Plan & Billing Status: Monitor your active plan, current renewal dates, and domain limits.

FAQ