Uptime-tool SSL add-ons and SSLMate-style monitors run $10 to $20 a month, roughly $360 to $720 over three years for 50 domains. One expired cert is a 2am page either way. Certwatch does a real TLS handshake against every site you care about on a schedule, and alerts you by email or webhook at 30, 14, 7 and 1 days before a cert or the domain itself expires. $24, once.

• Traffic-light dashboard — Green over 30 days, yellow at 30 or under, red under 7 days, or for expired, invalid or unreachable hosts.

• Real TLS handshake checks — Node tls checks expiry, issuer, SAN list, chain validity, self-signed certs and weak keys (RSA under 2048, EC under 224).

• Domain WHOIS expiry — Best-effort registry lookups so the domain registration itself does not lapse either.

• Threshold alerts — Configurable days (default 30, 14, 7, 1) via webhook and SMTP email, with exactly one alert per threshold per certificate.

• Chain viewer — See the full presented certificate chain per check in the UI.

• Check history — Every check is stored, and unreachable hosts are recorded with the error.

Runs as a Windows desktop app or on any $5 VPS (Docker included).

What's included:

• Full source code (MIT): https://github.com/bensblueprints/ssl-cert-monitor

• Lifetime v1 updates

• Setup guide (README quick start)