Expiry
Certificate expiry monitoring
Certwatch keeps the not-after date of certificates published for the domains you add. Those dates come from Certificate Transparency logs, so they describe issuance. A date in the inventory is the expiry of a certificate a server is using only when an endpoint probe says the served certificate matches that row.
What the inventory shows
Each stored certificate has names, issuer, serial, not-before, not-after, and, when the log included the certificate bytes, key information, signature algorithm, and a SHA-256 fingerprint. The inventory counts certificates that are already expired, expiring within 7 days, within 30 days, between 31 and 90 days, and later. Expired rows and rows inside 7 days are highlighted as urgent. Rows inside 30 days are highlighted as soon.
Filters cover search text, one domain, and windows of 7, 14, 30, 60, and 90 days. Owners, admins, and viewers can export the same fields as CSV. Cells that start with a spreadsheet formula character are prefixed so a spreadsheet does not treat them as formulas.
What remains after expiry
Once Certwatch has stored a certificate, the row stays after not-after passes. It does not disappear on the expiry date. Certificates that had already expired before the first successful log read may never appear. The primary source lists unexpired issuances, so a certificate that died before you added the domain is easy to miss.
What this does not do
Pro and Team can email selected members when a certificate is close to expiry. Team can also post to Slack, Teams, Discord, or a webhook. Certwatch does not renew or install anything. The endpoint comparison is how you check whether a later certificate from the logs is the one a host is serving. The Certificate Transparency page explains where the dates come from.
The mozilla.org demo is a public example of this inventory. It is not affiliated with Mozilla, and it is not probed.