Avoid expired certificates
An expired certificate immediately breaks a website, mail reception or an API. Usually it is not the main certificate but a forgotten server: the mail gateway, the LDAP server, an old test environment.
- Let's Encrypt issues certificates valid for 90 days, soon shorter. Renewal is automatic as long as the ACME client works. If it fails, nobody notices until the certificate expires. The ACME helper helps with the setup.
- Purchased certificates have been limited to 200 days since 2026, and to 100 days from 2027. Without automation, renewals become more frequent and an overview more important.
- Mail servers and LDAP are often forgotten. The overview also checks SMTP and IMAP with STARTTLS (ports 25, 587, 143) as well as 465, 993, 995 and LDAPS (636).
How to use the overview
- Enter host names, several at once if you like. For mail servers append the port:
mail.example.com:993. - “Check all” fetches the certificates one after another. The list is sorted by expiry date, the next one at the top.
- “Calendar (.ics)” creates an entry per certificate, as many days before expiry as set in “Warn from”. Import the file into Outlook, Google Calendar or Apple Calendar.
- For permanent monitoring, copy the matching configuration below into your monitoring system.
The list stays only in this browser. “Export list” saves it as a text file; “Import list” reads text, CSV or JSON files back in.
Check individual certificates in detail with chain, OCSP and key in the SSL check. The expiry of the domain itself is shown by the domain lookup (RDAP).
FAQ
Where is my host list stored?
Only in your browser’s local storage. hollop.net only receives the names one by one for checking and does not store them. Clearing your browsing data also clears the list, so export it first.
Why is there no automatic periodic check?
The page only runs while it is open. For permanent monitoring there are ready-made configurations for monitoring systems below and a shell script for cron.
How many servers can I add?
Up to 50. The check server allows about 30 checks in ten minutes. With longer lists the tool pauses and tells you when to continue.
Does it work for internal servers?
No. Checks run from the hollop.net server, which cannot reach internal names or private addresses. For internal servers use the shell script or your monitoring.
Are intermediate certificates considered?
The expiry date of the server certificate is shown. Whether the chain is complete and valid is checked by the SSL check.