FAQ
Questions about Certwatch
Short answers about public logs, expiry, live checks, and the mozilla.org demo. Longer notes are on the guide pages linked from the footer.
Does a certificate in Certwatch mean it is installed?
No. Certificate Transparency records issuance, not deployment. A name can show up because someone requested a certificate, even if it was never installed on a server.
Will Certwatch list every certificate ever issued for a domain?
It lists the issuances the public logs return. Cert Spotter is tried first, and crt.sh is the fallback when a domain has no certificates stored yet. Certificates that expired before the first successful read may be missing, because the primary source lists unexpired issuances. Once a certificate is stored, it stays after it expires.
How do I see expiry dates?
The inventory shows not-after and the days remaining. Expired certificates and those expiring within 7 days are highlighted one way, those within 30 days another. Filters cover 7, 14, 30, 60, and 90 days. Owners, admins, and viewers can export CSV.
How can I tell that a renewal was logged but not deployed?
Add a host under a domain you already watch. Certwatch completes a TLS handshake and compares the served certificate with the Certificate Transparency inventory. If the logs contain a related certificate that expires later than the one being served, the endpoint page says the renewal is not deployed. Free includes 3 manual live checks and does not schedule them. Pro checks each endpoint once a day. Team checks once a day. Certwatch does not install the new certificate for you.
Does Certwatch email me before a certificate expires?
Pro and Team can email selected members at 30, 14, 7, and 1 days before not-after, and again when a certificate is already expired. Team can also send Slack, Teams, Discord, and generic webhooks. Free does not send alerts. There is no customer API.
Who can see my inventory?
Only members of your organization. The mozilla.org demo is the only inventory available without signing in. Certwatch is not affiliated with Mozilla and holds no private data from Mozilla.
Does the public demo connect to mozilla.org?
No. The demo is built only from public Certificate Transparency logs for that domain name. It has no endpoints and is never probed.