What changed
FACT (signal 1845, r/sysadmin thread): Let's Encrypt is discontinuing its expiry-notification emails, and sysadmins are actively asking what to use instead. INFERENCE: this removes a free safety net from a very large installed base on a known date, creating a synchronized moment where renewal failures will spike.
Why now
The free notification layer disappears on a known date while the obligated class (every cert holder) is publicly enumerated in CT logs with exact expiry dates. HYPOTHESIS: a 60-90 day window exists before free substitutes fully absorb the displaced users; industry cert lifetimes are also shortening (CA/Browser Forum trajectory toward ~47-day certs), which multiplies renewal events — this is inference, not in the supplied evidence.
Converging signals
(1) FACT: Let's Encrypt ending expiry emails, users seeking replacements (Reddit PAIN evidence). (2) FACT about the world, not from supplied signals: CT logs publicly list every issued cert, its domain, and expiry — a complete, free, machine-readable roster of the 'obligated class'. (3) INFERENCE: browsers auto-enforce the sanction (hard interstitial) the moment a cert lapses, so the pain is existential and deadline-driven.
Customer pain
An expired cert takes the site down for every visitor instantly. The cohort at risk is specifically operators who relied on Let's Encrypt's emails because they do NOT have working auto-renewal or monitoring — small agencies, solo devs, legacy servers, side projects that still make money. The Reddit thread proves the anxiety exists (PAIN evidence, similarity 0.76).
Who pays
Small web agencies managing 10-200 client domains (strongest: one lapse = one lost client), solo SaaS operators, IT generalists at SMBs with a handful of self-hosted boxes. HYPOTHESIS: agencies are the real buyer; $5-15/mo individuals will churn.
Solved today
Free tiers of UptimeRobot/StatusCake, crt.sh lookups, cron scripts around certbot, hosting-panel auto-renewal (cPanel/Caddy/Traefik renew automatically), and free cert monitors (Red Sift Certificates Lite, TrackSSL free tier). The Reddit thread itself is users crowdsourcing exactly these free answers.
Why current solutions are bad
Free monitors require the owner to know they need one and to enroll each domain BEFORE the lapse — they are pull, not push. Nobody markets to the owner at the moment of maximum danger (cert in final 14 days, no successor issued). The defensible wedge here is not the monitor (commodity) but the CT-log-driven outbound engine that finds at-risk domains and reaches them pre-failure. That wedge is real but the product behind it is trivially copyable.
Proposed product
CertSentry: (a) CT-log scanner (crt.sh / certstream) flagging domains entering final 14 days with no replacement cert; (b) contact-derivation layer (site contact pages, published emails, LinkedIn for agencies — NOT scraped WHOIS blindly, see legal_risk); (c) rescue outreach sequence; (d) the paid product: multi-domain expiry monitoring with escalation (email→SMS→phone-call webhook), renewal-failure diagnosis hints, and an agency dashboard with client-facing reports. Per-domain pricing tiers.
MVP version
7-14 days: certstream/crt.sh poller + Postgres of (domain, expiry, successor-seen) + a manual outreach batch of 200 hand-verified contacts + Stripe checkout on a landing page. The testable prediction in the hypothesis (>=10k at-risk domains/week, >=1% outreach conversion) is exactly the right first experiment and costs almost nothing.
30-day build
Run the scanner for 2 weeks; validate hit volume. Hand-send 200-400 personalized rescue emails (stay under radar, measure deliverability and reply rate). Ship the monitoring dashboard only if replies show intent. Post the free 'is your cert about to lapse?' checker in r/sysadmin/r/webdev as inbound complement.
60-day build
If conversion >=1%: automate the outreach pipeline with proper suppression/opt-out, add agency tier ($29-79/mo for 25-200 domains), integrate escalation channels (Twilio SMS/voice). If <0.5%: kill outbound, keep the free checker as SEO/inbound asset or shut down entirely.
90-day revenue plan
HYPOTHESIS: 10k at-risk domains/week scanned, 2k reachable contacts/month, 1% conversion = 20 subs/month; blended $12/mo individual + a few $49/mo agencies ≈ $400-800 MRR by day 90. This is a modest-MRR business unless the agency tier dominates — sellability ceiling is the main strategic concern, not feasibility.
Distribution path
Primary: the CT-log outbound engine itself (the product IS the lead-gen). Secondary: free instant-check tool for SEO/Reddit/HN inbound. Matches founder's demonstrated-value-not-relationship selling. Key risk: cold email deliverability and spam-folder death at scale.
Pricing hypothesis
$7/mo single domain, $15/mo up to 10 domains, $49-99/mo agency tier with client reports. Per-domain overage. No free tier beyond the one-shot checker (free tier would cannibalize against already-free competitors).
Technical difficulty
Low. CT log consumption (certstream websocket or crt.sh queries), expiry diffing, email sequencing, Stripe. Well within a solo AI-assisted build in 1-2 weeks. Scale of CT firehose (~hundreds of certs/sec) needs modest infra the founder can now afford.
Legal / regulatory risk
MODERATE and channel-critical: unsolicited commercial email must satisfy CAN-SPAM (US: legal with opt-out and accurate headers) but GDPR/PECR makes cold-emailing EU individuals legally fraught — geo-filter targets or restrict to corporate/role addresses under legitimate-interest with easy opt-out. WHOIS contact data is mostly redacted post-GDPR anyway (weakens the roster-to-contact step, a real falsifier). No platform ToS risk on CT logs themselves — they are public by design.
Platform dependency
Low on data (CT logs are an open standard, multiple operators). High on email deliverability infrastructure — a spam-flagged sending domain kills the entire distribution engine. Mitigate with warmed domains and low daily volume.
Founder fit
HIGH on pattern (7-8): this is his proven 'forced-filer roster' shape — enumerable obligated class, hard deadline, auto-enforced sanction, per-unit monetization — and the lesson (conf 0.80) that such shapes fit him best applies. But NOT a government-portal mandate: no filing portal to automate into, so the per-transaction submission moat that made ELDT defensible is absent. The buyer is technical (sysadmins), who are the world's best at self-solving with free tools — a worse buyer than trucking schools.
Breakout potential
Moderate. Expansion: domain-expiry rescue, DMARC/SPF monitoring, the shortening-cert-lifetime trend (47-day certs would multiply renewal events ~8x and strengthen the thesis). The CT-outbound engine generalizes into 'roster-driven rescue outreach' for other auto-enforced deadlines. Could plausibly reach $3-10k MRR; unlikely venture-scale, which is fine for this founder.
Final recommendation
CONDITIONAL GO on a cheap 3-week experiment, not a product build. The pattern is right (enumerable roster, hard deadline, auto-enforced sanction) and the trigger event is real, but the buyer is self-solving and the product is a commodity — everything hinges on the outreach conversion number. Run the scanner, hand-send 200 emails, and let the >=1%-conversion / deliverability test decide. Do not build the dashboard first. If conversion clears 1% with agencies (not individuals) replying, build the agency tier; otherwise kill and keep the CT-scanner code as a reusable 'roster engine' for better-fit deadline-driven mandates.
Next action
Verify the Let's Encrypt discontinuation notice and date on letsencrypt.org (the single load-bearing FACT), then run a 7-day crt.sh/certstream scan counting domains <=14 days from expiry with no successor cert — this validates the >=10,000/week prediction before any outreach or build.