Guide
Choosing a certificate monitoring tool
A certificate monitor should answer a specific question. This page is the list Certwatch uses for itself: Certificate Transparency coverage, live endpoint checks, alert channels, pricing, and privacy. It also says when a different kind of tool is the better fit. It does not review other products.
Start with the question, not the brand
People shop for a monitor when they want a standing list of certificates for a domain and a date they can act on. The underlying record, if the tool reads public logs, is a Certificate Transparency entry. A publicly trusted certificate authority appends a certificate when it issues one. A monitor can show the names, the issuer, and the not-before and not-after dates. That record is issuance. It is not proof that a server is using the certificate, and it is not itself a renewal.
A certificate can be logged and never installed. A certificate from a private authority can be installed and never logged. Any tool in this category, including Certwatch, has to be read with that limit in mind. Certwatch keeps an inventory for the domains you add and lets you decide what to do with the dates. It does not claim to replace an uptime check or a feed of raw log entries you already trust.
How Certwatch approaches the inventory
For each domain on an account, Certwatch stores the certificates the logs return: names, issuer, serial when the source included it, not-before, not-after, and, when the certificate bytes were present, key information, signature algorithm, and a fingerprint. Expired rows stay after not-after passes. Certificates that had already expired before the first successful read are easy to miss, because the primary source lists unexpired issuances. Once a row is stored, it remains, including after it expires.
Refreshes are queued. A consumer reads one page per message, so a large name does not become one unbounded request. Customer refreshes can continue on later pages over successive runs. Daily caps pause that work until the next UTC day when the budget is reached. The dashboard says so. Those monitoring caps are separate from the cap on the public checker.
The free checker at the certificate lookup page answers a smaller question. It reads one page for one public domain, shows at most 40 certificates, and caches that page for about a day. It rejects IP addresses and internal names. It does not open a connection to the domain, and it does not email you when a date moves. Use it to see the shape of the logs. Use an account when the domain should still be there tomorrow.
Alerts and the certificate a host is serving
Email alerts are on Pro and Team. They can go to selected members at 30, 14, 7, and 1 days before not-after, and again when a stored certificate is already expired. Team can also post to Slack, Teams, Discord, or a generic webhook. Free does not send alerts. There is no customer API. An alert reports a date in the inventory. Certwatch does not renew the certificate and does not install it.
Logs do not tell you which certificate a host is serving. On an account, owners and admins can add a host and port under a domain the organization already watches. A small container completes a TLS handshake and compares the served certificate with the inventory. If the logs contain a related certificate that expires later than the one being served, the endpoint page says the renewal is not deployed. The public checker never probes. The public demo for mozilla.org is also logs only. Certwatch is not affiliated with Mozilla.
What to look for
Certificate Transparency coverage is the first item. Ask whether the tool lists issuances for the domain, including names you are not currently serving, and whether it keeps a row after not-after passes. Ask what it misses: private certificates, and certificates that expired before the first successful read. Certwatch reads public logs one page at a time for an account. The public checker reads one page, shows at most 40 certificates, and caches that page for about a day. It does not open a connection to the domain.
Live endpoint checks are the second item. Logs do not tell you which certificate a host is serving. A useful monitor can complete a TLS handshake for a host you name and compare that certificate with the inventory. If the logs contain a related certificate that expires later than the one being served, Certwatch says the renewal is not deployed. Free includes a few manual live checks and does not schedule them. Pro and Team check each endpoint once a day. The public checker never probes. The public demo is logs only, and Certwatch is not affiliated with Mozilla.
Alert channels are the third item. Email alerts on Certwatch are on Pro and Team, at 30, 14, 7, and 1 days before not-after, and again when a stored certificate is already expired. Team can also post to Slack, Teams, Discord, or a generic webhook. Free does not send alerts. There is no customer API. An alert reports a date. It does not renew or install the certificate.
Pricing and privacy are the last two. The public checker is free and does not require an account. Paid plans are listed on the pricing page. The checker caches a domain and the public certificates it found for about a day and does not record who asked. An account stores the email you sign in with, the domains you add, and the public certificates from the logs. Certwatch does not store card numbers. Payment, when you choose a paid plan, is handled by the seller of record.
When another kind of tool may fit better
Stay with a feed of newly logged certificates if you already have a place for expiry, deployment, and alerting. Use an uptime check if the question is whether a website responds and which certificate that one host presented during the check. That check will not list a certificate issued for a name you are not serving. Use a host scanner if you already know every name that terminates TLS and you only care what those hosts present.
Use Certwatch if you want the logged certificates for domains you run, the dates those certificates expire, a public one-page lookup before you sign up, and, on a paid plan, a comparison against a host you name plus an alert when a date is close. This page describes that approach. It is not a ranking of other products.
Questions
Does Certwatch connect to the domain during a public lookup?
No. The public checker reads one page of Certificate Transparency and caches it. A connection is made only when you add an endpoint on an account.
What should a certificate monitor cover?
Look for Certificate Transparency coverage, a way to check the certificate a host is serving, alert channels you will actually read, a price you can see, and a clear statement of what is stored.
Will the free checker send expiry email?
No. The free checker is one cached page. Email alerts start on Pro and Team. Slack alerts are on Team.
Look up a domain or start monitoring
The public checker reads one page of Certificate Transparency and does not connect to the domain. An account keeps the inventory. Alerts, when you want them, start on a paid plan.
Check a certificate Create an account
See pricing for what Free, Pro, and Team include. The mozilla.org demo is logs only and is not affiliated with Mozilla. Related: SSL monitoring for small teams · How Certificate Transparency is stored · Certificate Transparency monitoring.