Stop letting SSL certs expire on you.
Add a hostname. We open a real TLS handshake, read the cert, tell you days remaining, issuer, and SAN list. Daily checks. Email + Telegram alerts well before the renewal cliff.
Free tools (SSL Shopper, ssllabs.com, crt.sh) check one domain on demand. Certfly opens a real TLS connection on every dashboard load and parses the DER — so what you see matches what your users' browsers see, not what a stale CT log says.
Let's Encrypt auto-renew silently breaks more often than people admit — a deploy script forgets to reload nginx, a wildcard hits a rate limit, the renewal cronjob's user changed. We surface 'expired' and 'untrusted chain' on the same row, so you catch both classes of failure.
Issuer/SAN drift goes unnoticed: a CDN rotation or a misconfiguration changes the issuer or SAN list, but nothing flags it until end-users hit errors. We show you exactly which CN, which SANs, which signing algorithm — so the moment something flips, you see it.
Three steps. Done.
Add a hostname
Type example.com (or your subdomain), pick a port if it's not 443. Takes seconds. Free up to 5; Pro is unlimited.
We probe the TLS handshake
Real socket, real TLS, real DER. We extract subject CN, issuer, notBefore/notAfter, SANs, signing algo, OCSP-staple presence, days-until-expiry.
See it on the dashboard
Color-coded severity (ok > 30d, warn 7-30d, critical < 7d, expired). Hit 're-probe' to bypass the 5-min cache. History page shows every probe.
Built for these workflows.
Never get caught with an expired cert
Add your domains. Certfly checks the leaf cert daily, alerts at 30/14/3 days before expiry.
Monitor 200 customer subdomains
Bulk import via API. One Slack channel for the whole portfolio. Scale tier handles 5K+ domains.
Verify cert chain + OCSP + protocol
Beyond expiry: validates intermediate chain, OCSP status, TLS version. Catches misconfigured proxies before customers do.
We open a real TLS connection. Every time.
Most cheap SSL monitors poll Certificate Transparency logs — useful for issuance discovery, useless for catching a deploy that didn't reload its certificate. Certfly opens a TCP socket, runs the actual handshake, and reads the cert your users get. Same signal, less guessing.
Honest about Certfly vs alternatives.
Where we win, where they win, where it depends. We say it straight so you can pick what fits.
| Feature | Certfly | UptimeRobot SSL | Better Stack | ssl-checker.io |
|---|---|---|---|---|
| Free tier | 5 domains | ★50 monitors (mixed) | 5 monitors | Manual one-offs |
| Pro pricing | $9/mo | $8/mo | $25/mo | Free |
| Chain + OCSP validation | ✓Yes | Expiry only | Yes | Yes |
| API for bulk add | Yes (Pro) | Yes | Yes | No |
Renewal alerts long before users see a red padlock.
Indie. Solo. Honest about it.
Caddy auto-renews my certs but I have 30 customer subdomains where I don't control DNS. Got burned twice when a customer's CNAME broke and Caddy couldn't renew. Certfly tells me 30 days before expiry across all 30 — solo, Hetzner, $9/mo flat.
— Engagee LTD, the team behind Certfly.
What people are saying.
A few words from teams using Certfly.
“We had a cert quietly expire on an internal API last year and it cost us three hours of degraded service. Certfly now watches all 47 domains and tells us 30 days out. Never again.”
“Set up in under five minutes for a non-technical team. The dashboard shows green/red at a glance and the email reminder lands in the right inbox. No surprises since.”
“The fact that it watches the full chain — not just the leaf cert — caught a misissued intermediate the day before it would have broken half our subdomains. That's the value.”
“I run six side projects on different stacks. Certfly is the one place I check before I forget to renew anything. Cheap, fast, and the alerts are calm.”
“Telegram alert plus a 14/7/1-day reminder means our renewals never slip. We dropped the half-broken Nagios check we'd been maintaining and nobody missed it.”
“Managing certs for client sites used to be a calendar tax. Certfly handles it for sixty domains for less than what one cert renewal panic costs in agency hours.”
Pick a tier. Cancel anytime.
No annual lock-in, no enterprise sales calls.
Free
$0/forever
- ✓Up to 5 watched domains
- ✓Real TLS-handshake probe
- ✓Days-to-expiry + issuer + SANs
- ✓Probe history (last 300 events)
- ✓Manual re-probe button
Pro
$9/month
- ✓Unlimited watched domains
- ✓Custom non-443 ports
- ✓Same probe pipeline, no quota
- ✓Priority support
Real questions. Honest answers.
How often do you check? +
Sub-cert / wildcard support? +
What about non-443 ports? +
Does it check the chain? +
Slack/Telegram alerts? +
Pricing? +
Five domains free. Then $9.
No card to start. Add your first hostname now and see what your cert actually looks like.
Zero-Downtime SSL Renewal Guide
Let's Encrypt + multi-cert orchestration without 2am pages
Get the free PDFNo card. Just an email — and you can unsubscribe in one click.