Guide
SSL monitoring for small teams
A small team usually has a handful of domains, one or two people who notice expiry, and no time for a second inventory. This page is how Certwatch fits that shape: a free lookup, a stored list from public logs, and alerts only when someone should be told.
Two questions, kept separate
An uptime check asks whether a host answers. During a TLS handshake that check also sees the certificate the host presented, so it can warn you when that one certificate is close to expiry. That is a useful warning for the name you pointed it at. It is a poor inventory of every certificate issued for the domain, because it only observes the handshake it made.
Certificate Transparency asks what was issued. A name can appear because someone requested a certificate, even if you never installed it and even if the host is down. A private certificate that was never logged will not appear. Certwatch is built around issuance, and it can ask a narrower deployment question by probing a host you add. It is not an uptime monitor. It does not tell you that a homepage returned a successful status code. Keep the uptime check you already trust for outages.
Start with one domain
Open the public checker and type a domain you run. The page lists issuer, names, not-before, not-after, and days until expiry, and it calls out dates inside 30 days. IP addresses and internal names are rejected. The result is cached for about a day. Nothing connects to the domain. If the page is empty, that is not proof that no certificate exists. The primary source lists unexpired public issuances, one page at a time.
When the domain should still be there next month, create an account and add it. You do not upload certificate files and you do not change DNS. The scheduler queues a refresh and stores one page at a time: names, issuer, serial, not-before, not-after, and the extra fields when the source included the certificate bytes. Later pages follow on later runs. Expired rows stay, so a date that passed is still visible.
Subdomains are part of the log query, which is also how the public demo is filled. A name outside the domain is dropped. That keeps the inventory about the domains you added, not about every name that happened to share a certificate.
Alerts a small team will actually read
The inventory stores not-after from the logs. Expired rows and rows inside 7 days are highlighted as urgent. Rows inside 30 days are highlighted as soon. Filters cover 7, 14, 30, 60, and 90 days. Owners, admins, and viewers can export CSV. That is enough if someone opens the page. It is not enough if nobody does.
Email before those dates is on Pro and Team. Selected members can be mailed at 30, 14, 7, and 1 days before not-after, and when a certificate is already expired. Team adds Slack, Teams, Discord, and generic webhooks. Free does not send alerts. The message is a notice. It does not replace the certificate on the server. For a team of a few people, email to the person who renews certificates is usually the whole channel list. Add a chat webhook when the reminder should land in a channel the team already watches.
Check the host that clients actually reach
If you only watch the certificate a live check presents, you can miss a newer certificate that was logged and not deployed, and you can miss names you forgot. If you only watch the logs, you can think a problem is fixed because a new certificate exists, while the host is still serving the old one. Certwatch keeps those facts apart. The inventory is the log. An endpoint you add under a domain you already watch is the handshake.
Free includes a few manual live checks and does not schedule them. Pro and Team check each endpoint once a day. The endpoint page says whether the served certificate matches a stored row or whether a related row expires later. The probe refuses a private, loopback, or link-local address. It is not a scan of an internal network, and the public checker does not scan at all. The public demo never opens that connection.
A host scanner is the better fit when you already know every hostname that terminates TLS and you only care what those hosts present. Use Certwatch when the unknown issuances matter as well: names you did not list, certificates you did not install, and expiry dates in one inventory. A weekly pass is the upcoming list, then any endpoint that says a renewal is not deployed.
Questions
Does Certwatch replace an uptime check?
No. Certwatch does not check whether a website is up. It reads public certificate logs and, when you add an endpoint, the certificate that host presents.
Can a public lookup see the certificate the server is serving?
No. A public lookup never connects to the domain. Add an endpoint on an account to compare the served certificate with the logs.
Why can a lookup miss a certificate that is installed?
Private certificates and anything that expired before the first read are easy to miss. The primary source lists unexpired public issuances.
Look up a domain or start monitoring
The public checker reads one page of Certificate Transparency and does not connect to the domain. An account keeps the inventory. Alerts, when you want them, start on a paid plan.
Check a certificate Create an account
See pricing for what Free, Pro, and Team include. The mozilla.org demo is logs only and is not affiliated with Mozilla. Related: What to look for in a monitor · Renewed but not deployed · SSL certificate expiry monitoring.