CertPost monitors SSL/TLS certificates by opening a live connection and reading the certificate your server actually presents — not the renewal log, not CT logs. It validates the full chain (including intermediates), checks hostname match, and alerts by email or webhook at 30/14/7/1 days before expiry. Works on any TLS port (HTTPS, SMTP, IMAPS, custom). Free plan monitors 3 certificates forever, no card. Paid from $29/month for unlimited certificates — flat, not per-certificate.