diff --git a/sysutils/zrepl/Makefile b/sysutils/zrepl/Makefile
index ed56db478494..146f21339104 100644
--- a/sysutils/zrepl/Makefile
+++ b/sysutils/zrepl/Makefile
@@ -1,52 +1,55 @@
 PORTNAME=	zrepl
 DISTVERSIONPREFIX=	v
 DISTVERSION=	0.6.0
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	sysutils
 
 MAINTAINER=	driesm@FreeBSD.org
 COMMENT=	ZFS dataset replication tool
 WWW=		https://zrepl.github.io/
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		go:modules ncurses
 USE_RC_SUBR=	zrepl
 
 GO_MODULE=	github.com/${PORTNAME}/${PORTNAME}
 GO_BUILDFLAGS=	-ldflags "\
 		-s -w\
 		-X ${GO_MODULE}/version.${PORTNAME}Version=${DISTVERSIONFULL}"
 
-SUB_FILES=	pkg-message
+SUB_FILES=	pkg-message 500.zrepl
 
 OPTIONS_DEFINE=		EXAMPLES MANPAGES
 OPTIONS_DEFAULT=	MANPAGES
 
 MANPAGES_BUILD_DEPENDS=	${PYTHON_PKGNAMEPREFIX}sphinx>=1.8.5,1:textproc/py-sphinx@${PY_FLAVOR}
 MANPAGES_USES=		gmake python:build,3.6+
 MANPAGES_PLIST_FILES=	man/man1/zrepl.1.gz
 
 post-build-MANPAGES-on:
 	@${MAKE_CMD} -C ${WRKSRC}/docs SPHINXBUILD=sphinx-build-${PYTHON_VER} man
 
 post-install:
 	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR} \
 		${STAGEDIR}${ETCDIR} \
 		${STAGEDIR}${PREFIX}/etc/newsyslog.conf.d \
 		${STAGEDIR}${PREFIX}/etc/syslog.d \
 		${STAGEDIR}/var/run/zrepl
 	${INSTALL_DATA} ${FILESDIR}/newsyslog.conf ${STAGEDIR}${EXAMPLESDIR}/newsyslog.conf
 	${INSTALL_DATA} ${FILESDIR}/syslog.conf ${STAGEDIR}${EXAMPLESDIR}/syslog.conf
 	${INSTALL_DATA} ${FILESDIR}/zrepl.yml ${STAGEDIR}${ETCDIR}/zrepl.yml.sample
+	${MKDIR} ${STAGEDIR}${PREFIX}/etc/periodic/weekly
+	${INSTALL_SCRIPT} ${WRKDIR}/500.zrepl \
+		${STAGEDIR}${PREFIX}/etc/periodic/weekly/500.zrepl
 
 post-install-EXAMPLES-on:
 	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}/hooks
 	(cd ${WRKSRC}/config/samples && ${COPYTREE_SHARE} . ${STAGEDIR}${EXAMPLESDIR})
 	${INSTALL_DATA} ${WRKSRC}/dist/grafana/grafana-prometheus-zrepl.json ${STAGEDIR}${EXAMPLESDIR}
 
 post-install-MANPAGES-on:
 	${INSTALL_MAN} ${WRKSRC}/docs/_build/man/zrepl.1 ${STAGEDIR}${PREFIX}/man/man1
 
 .include <bsd.port.mk>
diff --git a/sysutils/zrepl/files/500.zrepl.in b/sysutils/zrepl/files/500.zrepl.in
new file mode 100644
index 000000000000..b7f1b3abb4d3
--- /dev/null
+++ b/sysutils/zrepl/files/500.zrepl.in
@@ -0,0 +1,41 @@
+#!/bin/sh
+
+# Check zrepl SSL certificates for impending expiration each week
+#
+# Add the following lines to /etc/periodic.conf:
+#
+# weekly_zrepl_enable (bool):	Set to "NO" by default
+# weekly_zrepl_warntime (int): Set to one month's worth of seconds by default
+
+# If there is a global system configuration file, suck it in.
+#
+if [ -r /etc/defaults/periodic.conf ]
+then
+    . /etc/defaults/periodic.conf
+    source_periodic_confs
+fi
+
+# 30 days in seconds
+: ${weekly_zrepl_warntime="2592000"}
+
+rc=0
+case "$weekly_zrepl_enable" in
+    [Yy][Ee][Ss])
+	echo
+	echo "Check Zrepl certificates for upcoming expiration:"
+
+	for cert in `/usr/bin/find %%ETCDIR%% -maxdepth 1 -name *.crt`; do
+		/usr/bin/openssl x509 --in "${cert}" \
+			-checkend "${weekly_zrepl_warntime}"
+
+		if [ $? -gt 0 ]; then
+			echo "${cert} will expire soon"
+			/usr/bin/openssl x509 --in "${cert}" -noout -enddate
+			rc=3
+		fi
+	done
+	;;
+    *)  rc=0;;
+esac
+
+exit $rc
diff --git a/sysutils/zrepl/files/pkg-message.in b/sysutils/zrepl/files/pkg-message.in
index f01100004e97..9d0cc7020a45 100644
--- a/sysutils/zrepl/files/pkg-message.in
+++ b/sysutils/zrepl/files/pkg-message.in
@@ -1,27 +1,37 @@
 [
 { type: install
   message: <<EOM
 Messages from sysutils/zrepl:
 
 SETUP BEFORE FIRST USE:
 - Create the log file /var/log/zrepl.log:
   # service newsyslog restart
 - Teach syslogd to redirect facility local0 to the zrepl.log file:
   # service syslogd reload
 - Modify the %%PREFIX%%/etc/zrepl/zrepl.yml configuration file
 - For remote backups, create the SSH key pair and authorized_keys file
 - Enable the zrepl daemon to start automatically at boot:
   # sysrc zrepl_enable="YES"
 - Start the zrepl daemon:
   # service zrepl start
   
 Documentation: https://zrepl.github.io/
 Changelog:     https://zrepl.github.io/master/changelog.html
 
 DANGER - SNAPSHOT PRUNING REQUIRES EXPLICIT KEEP RULES:
 For any ZFS snapshot that you want to keep, at least one rule must match.
 This also applies to snapshots taken by means other than zrepl
 (e.g. snapshots taken manually or via boot environment tools).
+
+In order to automatically warn the operator of impending certificate
+expiration, add this line to /etc/periodic.conf:
+
+    weekly_zrepl_enable="YES"
+
+More config details in the zrepl periodic script:
+
+    %%LOCALBASE%%/etc/periodic/weekly/500.zrepl
+
 EOM
 }
 ]
diff --git a/sysutils/zrepl/pkg-plist b/sysutils/zrepl/pkg-plist
index c26b48a40cc9..a11961d1fa43 100644
--- a/sysutils/zrepl/pkg-plist
+++ b/sysutils/zrepl/pkg-plist
@@ -1,24 +1,25 @@
 bin/zrepl
+etc/periodic/weekly/500.zrepl
 @sample %%ETCDIR%%/zrepl.yml.sample
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/bandwidth_limit.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/grafana-prometheus-zrepl.json
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/hooks/template.sh
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/local.yml
 @sample %%EXAMPLESDIR%%/newsyslog.conf etc/newsyslog.conf.d/zrepl.conf
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/pull.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/pull_ssh.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/push.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/quickstart_backup_to_external_disk.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/quickstart_continuous_server_backup_receiver.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/quickstart_continuous_server_backup_sender.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/quickstart_fan_out_replication_source.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/quickstart_fan_out_replication_target.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/sink.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/snap.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/snap_cron.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/source.yml
 %%PORTEXAMPLES%%%%EXAMPLESDIR%%/source_ssh.yml
 @sample %%EXAMPLESDIR%%/syslog.conf etc/syslog.d/zrepl.conf
 @dir etc/newsyslog.conf.d
 @dir etc/syslog.d
 @dir(root,wheel,0750) /var/run/zrepl