Let's Encrypt no longer emails you before a certificate expires

What changed

Let's Encrypt announced in early 2025 that it would stop sending expiration notification emails, and ended the service on June 4, 2025. The reasons it gave were that most subscribers renew automatically, that storing millions of email addresses was a privacy cost, and that the notices were expensive to run.

Nothing changed about the certificates themselves. They are still valid for ninety days, and ACME clients still renew them, typically with thirty days left.

Why renewals fail without anyone noticing

Automatic renewal depends on things that change. A renewal that worked for two years can stop because of something unrelated to certificates.

1. The DNS record used for validation was changed or the domain moved to a different DNS provider.
2. A firewall or CDN rule now blocks the HTTP validation path.
3. The server was migrated and the scheduled renewal job was not moved with it.
4. An API token for DNS validation expired or was rotated.
5. A CAA record was added that does not authorise the certificate authority.
6. The certificate renewed correctly but the web server was never reloaded, so it still serves the old one.

The last case is the one checks miss

A renewal log that says success is not proof. What matters is the certificate a visitor is actually served. The only reliable check connects to the site from outside and reads the expiry date of the certificate in the handshake.

The same is true for services other than the website: a mail server, an API host or a subdomain can each serve a different certificate with a different expiry.

How to monitor expiry yourself

Check from outside the server, on a schedule, and alert with enough time to act.

1. List every hostname that serves a certificate, including subdomains and mail hosts.
2. Check each one externally at least daily and read the served certificate's expiry.
3. Alert when fewer than fourteen days remain. With thirty-day renewal, that means renewal has already been failing for two weeks.
4. Send the alert somewhere a person reads, not to the mailbox that used to receive the Let's Encrypt notices.
5. Check that the certificate covers the hostname and that the chain is complete, not only the date.

For agencies managing client sites

Client sites usually sit on hosting the agency does not control, with renewal set up by someone who has since left. The expiry email was often the only signal that reached the agency at all. External monitoring across every client domain replaces that signal and turns an outage reported by the client into a renewal fixed before it.