Let's Encrypt does this by checking their records and determining whether a recent enough certificate was issued for your domains. They don't monitor your site to check the actual expiration dates of the certificates you use in production. This could be an issue if you run into a problem where you get a new certificate for your domains, but fail to deploy it (or something similar).