How Certwatch works

What gets recorded

For each domain in an organization, Certwatch stores certificates it finds in Certificate Transparency: names, issuer, serial, not-before, not-after, key information, signature algorithm, source, and a fingerprint when the log includes the certificate. Expired rows stay visible and are highlighted. Certificates that expired before Certwatch ever saw them may be missing, because the primary source lists unexpired issuances. Once a certificate has been stored, it remains after it expires.

What this version does not do

It does not send alerts. There is a small sink interface for Slack, Teams, webhooks, and email later. Nothing is delivered today. The public demo never opens a connection to utk.edu.

Signing in

Accounts are passwordless. Enter your email and Certwatch sends a link that expires in about 15 minutes and works once. The link is stored only as a hash, and it is bound to the address that requested it. Asking for a link looks the same whether or not that address already has an account. In production the message is sent with Resend from Certwatch <no-reply@certs.playedu.games>. Local development prints the link in the worker log instead, and that log mode cannot run in production.

Organizations and roles

The first person to create an organization is its owner. Owners and admins can add domains and invite people. Owners change roles. Viewers can read the inventory and export CSV. Every row belongs to one organization. An audit log records sign-ins, domain changes, invites, role changes, and exports for owners and admins.

Refresh

A cron trigger runs every 5 minutes and only enqueues work. Queue consumers refresh one Certificate Transparency page per message, or probe one endpoint. Cert Spotter is tried first, with crt.sh as a fallback when a domain has no certificates yet. An optional Cert Spotter API token raises the public rate limit. Daily caps stop the scheduler when usage would exceed the budget. The dashboard then shows a Paused for budget notice until the next UTC day.

Endpoint probes

Owners and admins can add a host and port under a domain they already watch. The hostname has to belong to that domain. Allowed ports are 443, 465, 993, 995, and 636 for implicit TLS, and 25, 587, 2525 (SMTP), 143 (IMAP), 110 (POP3), and 389 (LDAP) for STARTTLS. A small container completes the TLS handshake and returns the leaf and chain. Each endpoint is probed at most every 6 hours, including a manual probe. The endpoint page compares the served certificate with the Certificate Transparency inventory and calls out a renewal that was logged but is not deployed.

The probe resolves DNS inside the container and refuses the connection when any address is private, loopback, link-local, or shared address space. The public demo has no endpoints and is not probed.

Reading the table

Filters cover search text, domain, and windows of 7, 14, 30, 60, and 90 days. CSV export includes the same fields and prefixes cells that start with a spreadsheet formula character.

The public demo

The utk.edu demo is read-only and needs no account. It is assembled from public logs for that domain. Certwatch is not affiliated with the University of Tennessee and did not receive any data from the university.

Privacy

Certwatch stores your email, the domains you add, the public certificates it finds, session records, and the audit log. Magic-link tokens and session cookies are stored as hashes. The session cookie is HttpOnly, Secure on HTTPS, and SameSite=Lax. Sign-in attempts are rate limited per IP and per email.

Pricing

Early pricing

Early pricing; billing isn't live yet

Nothing is billed. These limits are the introductory plans, and they are not enforced yet.