Cert Monitor keeps an inventory of your domains' TLS certificates, with a push to your iPhone at 30, 14, 7 and 1 days before one expires and immediately if the chain stops validating. What actually runs the check is the part most pages skip, so it has a section of its own below. One domain is free, Guardian watches 5 and Guardian Plus watches 50.
Download PingKit for iPhoneAnd PingKit Agent on the Mac, for the hourly poll
Free to download. One domain is free with push. The push lands on the iPhone, so start there. Guardian watches five domains for $2.99 a month or $24.99 a year; Guardian Plus watches 50 for $9.99 a month or $79.99 a year on iPhone and iPad, $4.99 a month or $39.99 a year on Mac. Every plan has a 1-week trial.
Add a domain, and a port if it is not 443. A check connects over TLS, reads the certificate chain and reports the result to PingKit's backend. The backend compares the newest report against the thresholds and pushes a notification to your iPhone 30, 14, 7 and 1 days before the certificate expires, and immediately if the chain stops validating. It works from the newest report and treats one over three hours old as no report at all, so an old reading never sets off a warning. Which app runs the check, and how often, is the next section.
One domain is free, permanently, with the full alert schedule. Guardian raises the limit to 5, and Guardian Plus to 50 with the signed compliance PDF.
Four warnings before expiry, spaced so the first arrives while a renewal is still routine and the last while there is still time.
A missing intermediate, an untrusted root or a mismatched name is reported on the next check, not on the next expiry.
Alerts arrive as push notifications on your iPhone, which matters now that Let's Encrypt no longer emails expiry warnings. The Mac Agent cannot receive a push; with Guardian it shows its own notification when a certificate in its list nears expiry. Guardian Plus also sends every alert by email and to a webhook you choose.
If a Mac sends no reading for 18 hours, longer than a night's sleep, the backend says so once, by Guardian Plus email or webhook, rather than leaving you to assume all is well.
The honest version, because it decides how you use this. Each device keeps its own list. On the iPhone, a check runs when you tap Poll all now, because iOS does not let an app keep probing in the background and PingKit does not pretend otherwise; that is also the list the backend sends expiry pushes for. In the Mac Agent, every domain in its list is polled once an hour for as long as the Agent is running, whether or not the Cert Monitor window is open. Open that pane once so the Mac registers itself; after that the clock runs without it. The Mac gives you the full inventory on screen and the on-demand check. macOS has no push channel here, so on the free tier the Mac's list is a view rather than an alarm; with Guardian the Agent shows a notification on the Mac when a certificate reaches 30, 14, 7 or 1 days, and Guardian Plus sends the Mac's alerts by email or to a webhook, which reach you away from it. Guardian Plus is cheaper on the Mac all the same: $4.99 a month against $9.99 on the iPhone.
With no Mac, the iPhone is the whole feature: add the domain, tap Poll all now when you want the inventory refreshed, and the backend pushes the expiry warning off that check. Because the warning is computed from the newest report, and a report over three hours old does not count, this is a watch list you check into rather than an unattended alarm. An iPhone is expected to go quiet between visits, so the backend never reports one as stale.
It does not report the negotiated TLS version or cipher suite. Cert Monitor answers one question well: will this certificate still be valid next week, and is the chain intact today. The on-demand SSL Inspector reads the same chain for any host without adding it to a watch list.
| Free | Guardian | Guardian Plus | |
|---|---|---|---|
| Monitored domains | 1 | 5 | 50 |
| Push to the iPhone for its list | 30, 14, 7, 1 days; chain failure | Same | Same |
| Notification on the Mac for its own list | No | 30, 14, 7, 1 days | 30, 14, 7, 1 days |
| Alerts by email and to a webhook, and a Mac silent for 18 hours reported | No | No | Yes |
| Signed compliance PDF | No | No | Yes |
| Price in the Mac Agent | $0 | $2.99/mo or $24.99/yr | $4.99/mo or $39.99/yr, 1-week trial |
| Price on iPhone and iPad | $0 | $2.99/mo or $24.99/yr | $9.99/mo or $79.99/yr, 1-week trial |
A subscription bought on either the iPhone or inside the Mac Agent unlocks the same tier on both through iCloud. Guardian covers a handful of domains, alongside the Mac Agent on your phone and ten Uptime Watch URLs; Guardian Plus is for a longer list, the signed PDF and alerts that reach an inbox or a team channel.
Guardian Plus exports a PDF inventory of every monitored domain with the fields above, plus your Uptime Watch targets, citing ISO/IEC 27001:2022 Annex A controls A.5.37, A.8.15 and A.8.8. The file carries its own Ed25519 signature, generated on the exporting device, with the public key printed in the footer of every page; any edit, including re-saving from a viewer, breaks it. It exports from the Mac Agent's Reports pane and from the iPhone. How the inventory replaces the spreadsheet, and which controls it evidences.
Yes. PingKit monitors one domain free of charge, permanently, with push notifications at 30, 14, 7 and 1 days before expiry and immediately on a chain failure. Guardian raises the limit to 5 domains and Guardian Plus to 50.
For the domains you add, yes: with a push, and with Guardian Plus by email as well if you want one. Let's Encrypt ended its expiration notification emails on June 4, 2025. Cert Monitor's 30, 14, 7 and 1 day alerts cover a 90-day certificate comfortably. For the 6-day certificates Let's Encrypt made generally available in January 2026, the alert that matters is the one at 1 day, which fires only if automated renewal has already failed.
No. iOS does not allow it. On the iPhone a check runs when you tap Poll all now; in the Mac Agent it runs once an hour for as long as the Agent is running. PingKit's backend pushes the alerts for the iPhone's list to the iPhone. The Mac cannot receive a push, so with Guardian the Mac Agent shows its own notification when a certificate in its list reaches 30, 14, 7 or 1 days, and Guardian Plus can also send either list's alerts by email or to a webhook.
A sleeping Mac does not poll; an awake one polls every hour while the Agent is running, whether or not the Cert Monitor pane is open. If a Mac sends no reading at all for 18 hours, longer than a night's sleep, the backend says so once, by the email or webhook Guardian Plus sends alerts to, and again only after the Mac has reported since. For continuous coverage, turn off sleep while plugged in under System Settings.
Guardian, for up to five. It is $2.99 a month or $24.99 a year, on iPhone and on Mac. Guardian Plus watches up to 50 and is $4.99 a month or $39.99 a year in the Mac Agent, and $9.99 a month or $79.99 a year on iPhone and iPad. Every plan has a 1-week free trial. A subscription bought on either the iPhone or inside the Mac Agent unlocks the same tier on both through iCloud.
Add the domain on your iPhone, which is where the expiry push lands, and keep the same inventory open in the Mac Agent if you want it polled hourly on a bigger screen.
Get PingKit Agent on the Mac App StorePingKit for iPhone on the App Store
The Mac Agent requires macOS 15 or later; PingKit for iPhone requires iOS 17.0 or later. All 19 tools free, forever.
Renewal crons are silent when they fail, and a reverse proxy can keep serving the old certificate long after certbot thinks it succeeded. Noxen, our sister Mac app, checks TLS on every Linux and VPS host it audits, nightly. Cert Monitor watches the public endpoints you add; Noxen watches the fleet.
TLS expiry on self-hosted services →