certpeek

A tiny command-line tool that connects to each host, reads the certificate that is actually served and prints how many days are left. It exits non-zero when anything is below the threshold or unreachable, so it fits straight into a systemd timer. Background in Let's Encrypt renewals that never surprise you.

$ certpeek --warn 21 example.com seyshee.dev mail.example.com:993
example.com           OK     67 days  (Let's Encrypt R11, TLSv1.3)
seyshee.dev           OK     74 days  (Let's Encrypt R10, TLSv1.3)
mail.example.com:993  WARN   12 days  (Let's Encrypt R11, TLSv1.3)

Standard library only, Python 3.8+. The tarball includes a sample systemd service and timer.

Changelog

• 0.4.0 (2026-08-29) — host:port syntax, TLS version in the output, --quiet.
• 0.3.0 (2026-03-11) — exit code 2 for unreachable hosts.
• 0.2.0 (2025-11-02) — issuer name in the output.
• 0.1.0 (2025-09-20) — first version.

Download

Full checksums: SHA256SUMS