Daily check of SSL certificate expiration dates for a list of domains. Notifies when any certificate is within the configured renewal window.

Provided free and as is, without warranty of any kind — including merchantability, fitness for a particular purpose, and the accuracy or completeness of any result. See the licence. You are responsible for checking what this produces before relying on it.

SSL Certificate Watch

Daily check of SSL certificate expiration dates for a list of domains. Notifies when any cert is within the configured renewal window (default 30 days) or has already expired.

What it does

The monitor's check runs a bash one-liner that hits each domain on port 443 via openssl s_client, parses the notAfter date, and computes days remaining. Per-domain status lines are tagged OK or ALERT. A summary line emits ALERT when at least one domain is in trouble.

The when: arm uses contains ALERT to gate notification — quiet on healthy days, single alert email on the day something needs attention.

Edit before installing

In monitor.iml:

The DOMAINS=(...) array — list every domain:port pair you want to watch.
THRESHOLD_DAYS=30 — renewal window. Lower (e.g. 14) for aggressive monitoring, higher (e.g. 60) for slow renewal workflows.
Schedule daily — running this more often wastes openssl handshakes and spams alerts on persistent issues.

Bindings used

{{check.output}} — full bash output: per-domain status lines + summary.

Tools used

runtimeenv — core InTouch task type, executes the inline bash script. Requires openssl on the runtime environment's PATH (standard on Linux/Mac/Git Bash).

Previous form

Replaces the ssl-cert-expiration job (deleted 2026-05-19). Same logic; the monitor variant uses the standard quiet-by-default pattern instead of always sending a digest.