Uptime-tool SSL add-ons and SSLMate-style monitors run $10 to $20 a month, roughly $360 to $720 over three years for 50 domains. One expired cert is a 2am page either way. Certwatch does a real TLS handshake against every site you care about on a schedule, and alerts you by email or webhook at 30, 14, 7 and 1 days before a cert or the domain itself expires. $24, once.
If you've searched for a SSLMate-style SSL monitors alternative, Certwatch is the pay-once option worth putting at the top of the list: Certwatch is $24, one time, and covers the same core job SSLMate-style SSL monitors charges $10–20/mo for.
What makes Certwatch the pick for 2026
- Traffic-light dashboard — Green over 30 days, yellow at 30 or under, red under 7 days, or for expired, invalid or unreachable hosts.
- Real TLS handshake checks — Node tls checks expiry, issuer, SAN list, chain validity, self-signed certs and weak keys (RSA under 2048, EC under 224).
- Domain WHOIS expiry — Best-effort registry lookups so the domain registration itself does not lapse either.
- Threshold alerts — Configurable days (default 30, 14, 7, 1) via webhook and SMTP email, with exactly one alert per threshold per certificate.
- Chain viewer — See the full presented certificate chain per check in the UI.
Certwatch vs SSLMate-style SSL monitors, at a glance
| Certwatch | SSLMate-style SSL monitors | |
|---|---|---|
| Price | $24 once | $10–20/mo |
| 3 years, 50 domains | $24 | $360–720 |
| Handshake checks (expiry, chain, keys) | Yes | Yes |
| Domain (WHOIS) expiry | Yes, best-effort | Sometimes |
| Email + webhook alerts | Yes | Yes |
| Data on your server | Yes | No |
| Domain limits | None | Usually tiered |
| Source you can read | Yes, MIT | No |
Two months of a paid SSL monitor covers Certwatch, and one cert it saves from expiring covers the 2am page it would have cost you.
Common questions
Is it really free on GitHub?
Yes. Certwatch is MIT-licensed at github.com/bensblueprints/ssl-cert-monitor-mvp and always will be. The $24 buys the packaged 1-click installer; building from source is free.
Where does my monitoring data live?
In a SQLite database on your own server. The checker connects directly to your hosts, so run it from a box that can reach them, and nothing goes to any third-party API.
How reliable is the domain-expiry check?
Certificate checks are the reliable signal. WHOIS domain expiry is best-effort: some TLDs publish no expiry and some rate-limit, so treat it as a bonus rather than the primary alarm.
The bottom line
Certwatch won't out-feature SSLMate-style SSL monitors on every axis — no subscription tool with a bigger team and a bigger roadmap loses on everything. But for the core job, $24 once against $10–20/mo forever is a trade most people should at least look at. Certwatch is part of OneTimeSuite, a catalog of pay-once apps that replace subscription SaaS.
Try Certwatch — $24, once
Real TLS handshake checks on a schedule with 30/14/7/1-day email and webhook alerts.