Let's Encrypt Stopped the Expiry Emails. Here's What Replaces Them.

Let's Encrypt announced in January 2025 that it would end expiration notification emails, citing cost, privacy and the fact that most users now renew automatically. The service ended on June 4, 2025, and it deleted the email addresses it had stored for it.

Nothing changed about issuing or renewing certificates. What disappeared is the warning that arrived when renewal had quietly failed.

Auto-renewal fails silently more often than people expect: a cron job or systemd timer stops running, a firewall or DNS change breaks the validation challenge, the server moved, or a cert renewed but the web server was never reloaded. The old email was how most people found out. Without it, the first warning is often a visitor seeing "Your connection is not private".

Renewals are also getting more frequent. Public certificates are capped at 200 days since March 2026 and drop to 47 days by 2029, so there are more chances for a renewal to break.

Check it yourself. certbot certificates lists your certs and expiry dates. certbot renew --dry-run tests that renewal will work. Good for one server, easy to forget.

A free external monitor. Something outside your server that checks the live certificate on a schedule and emails you weeks ahead. It catches renewal failures and the "renewed but not reloaded" case, because it looks at what visitors actually get.

Behind Cloudflare? An outside check only sees Cloudflare's edge certificate. Your Let's Encrypt cert on the origin can expire without any public checker noticing, until Cloudflare starts throwing Error 526. You need a monitor that checks the origin directly.

DomainCat's free plan watches the SSL certificates on up to 5 domains, including the origin cert behind Cloudflare, every 6 hours, and emails you 30, 14 and 7 days before one expires. No agent to install, no credit card. Paid plans add domain registration expiry, blacklist and DNS change alerts.

Does Let's Encrypt still send expiration emails?
No. Let's Encrypt ended expiration notification emails on June 4, 2025, and deleted the email addresses it had stored for that service.

Why did Let's Encrypt stop sending expiry emails?
It cited the cost of running the service, the privacy downside of storing millions of email addresses, and the fact that most subscribers now renew automatically.

How do I get notified before a Let's Encrypt certificate expires?
Use an external certificate monitor that checks the live certificate on a schedule and emails you in advance. Free plans exist, including DomainCat's, which covers up to 5 domains.

My site is behind Cloudflare. Do I still need to watch my Let's Encrypt cert?
Yes. If the zone uses Full (strict), an expired origin certificate causes Error 526 even though Cloudflare's edge certificate stays valid. Public checkers only see the edge, so monitor the origin directly.