Let's Encrypt has ended certificate expiration reminder emails. For many teams, those messages were the last line of defense when automation drifted or ownership changed. That safety net is gone—and responsibility now sits entirely inside your monitoring stack.
What changed in Let's Encrypt (and why it matters)
The CA is encouraging proper automation instead of inbox fallbacks. Even when renewal scripts exist, they can fail without anyone noticing: DNS challenges break, permissions change, rate limits hit, or staging certs get promoted incorrectly.
Most production gaps share the same pattern:
- No alert when renewal fails
- No visibility across subdomains and services
- No confirmation the live cert matches what you expect
- Certificates owned by people who left the company
Why expiry emails were never enough
Emails felt reliable, but they were easy to miss—filtered, ignored, or sent to the wrong distribution list. The real failure mode is organizational: nobody owns the cert until something breaks in production.
The real risk: silent certificate expiration
Websites, APIs, load balancers, and background jobs all depend on valid TLS. A single expired certificate can cascade across services while monitoring still reports "up" at the HTTP layer.
Typical symptoms include browser warnings, rejected API requests, broken internal mesh traffic, and hours spent tracing a root cause that was a date field on a cert.
Infrastructure health, not inbox luck
Rootwise tracks certificate expiry, chain validity, and related DNS context from the outside—like your users and mail providers see it. You get severity-rated issues instead of scattered reminders.
What a modern SSL monitoring setup looks like
Auto-renewal via ACME is table stakes. The differentiator is verification: did renewal succeed, is the new cert served, and will it expire before the next window?
- Discover all certificates across environments
- Track expiration and issuer in one dashboard
- Alert on renewal failure—not only on expiry date
- Integrate with DNS health so challenge failures surface early
Pair this with mail and DNS monitoring and you cover the majority of customer-facing failure paths—not just the cert file on disk.