Let's Encrypt no longer sends expiration emails: how to stay informed

For years, Let's Encrypt sent an email when a certificate was nearing expiry without having been renewed. For many administrators, it was the only sign that an automatic renewal was broken. This service ended on June 4, 2025.

What changed

Let's Encrypt announced the end of reminder emails in January 2025, then stopped them on June 4, 2025. Today:

• No email is sent before expiry, even if a certificate hasn't been renewed.
• The email address you gave Certbot or another ACME client is no longer used for these reminders.
• Nothing changes for certificate issuance or renewal.

Why Let's Encrypt stopped

The organization gave several reasons:

• Automatic renewal is the norm: the vast majority of ACME clients renew without human intervention.
• Privacy: no longer storing millions of email addresses tied to certificates.
• Cost: sending these emails cost tens of thousands of dollars a year for a nonprofit.

Let's Encrypt now recommends using a third-party monitoring service.

Why it's a real risk

Automatic renewal works… until the day it doesn't. The most common causes:

• port 80 was closed by a firewall rule;
• DNS now points to another server or a CDN;
• the server was migrated without bringing over Certbot or its scheduled task;
• the certificate is renewed on disk, but the web server was never reloaded;
• a DNS plugin no longer has the right API credentials.

In all of these cases, nobody is notified. The first sign is visitors hitting NET::ERR_CERT_DATE_INVALID, or an API refusing connections.

And the margin is going to shrink: Let's Encrypt certificates will drop to 64 days in 2027, then to 45 days in 2028.

How to replace these emails

Option 1: monitor from the outside (recommended)

A monitoring service checks the certificate actually served by your site, just like a visitor would. It's the only method that also catches servers that were never reloaded and forgotten load balancers.

With SSL Expiration Reminder:

1. Create a free account: up to 3 domains, no credit card required.
2. Add your domains, one by one or with a CSV import.
3. Choose when to be notified. For Let's Encrypt, a 15-day reminder is ideal: by that point, a healthy certificate should already have been renewed. If the alert arrives, your automation has a problem.

Paid plans add Slack, Telegram and webhooks, and let you notify several people. That's useful when the address given to Certbot belonged to a former colleague.

Option 2: a homemade script

For one or two servers, a cron job may be enough:

#!/bin/sh
# Alert if the served certificate expires in less than 15 days (1,296,000 seconds)
DOMAIN=example.com
echo | openssl s_client -connect "$DOMAIN:443" -servername "$DOMAIN" 2>/dev/null \
  | openssl x509 -noout -checkend 1296000 \
  || echo "The certificate for $DOMAIN expires soon" | mail -s "SSL $DOMAIN" you@example.com

Limitations: you need a working mail server, the script often runs on the very machine it monitors, and nobody monitors the script itself.

Option 3: check Certbot regularly

sudo certbot renew --dry-run
sudo certbot certificates

This is useful for troubleshooting, but it's still a manual process. And it doesn't tell you which certificate is actually being served to visitors.

Summary

• Let's Encrypt no longer warns you before expiry, since June 4, 2025.
• Automatic renewal can fail silently.
• External monitoring, with alerts sent to several people, is a better replacement for the old emails.

You can check a domain right now with the free SSL checker.