Detect certificates renewed but not deployed

Add the host you want checked

Owners and admins add a hostname and port under a domain the organization already watches. The hostname has to belong to that domain. Implicit TLS is allowed on 443, 465, 993, 995, and 636. STARTTLS is allowed on 25, 587, and 2525 for SMTP, 143 for IMAP, 110 for POP3, and 389 for LDAP. You can set a separate SNI name. It defaults to the host.

A small container completes the handshake and stores the leaf and chain. DNS is resolved inside that container. If any address is private, loopback, link-local, or shared address space, the connection is refused. The public demo has no endpoints and is never probed.

How the comparison is decided

The endpoint page looks at Certificate Transparency rows whose names overlap the served certificate and the domain. If one of those rows expires later than the certificate being served, the page says the renewal is not deployed. If the served fingerprint or serial matches a stored row, and nothing related expires later, the page says they match. If the served certificate overlaps the domain but its serial and fingerprint are not in the stored inventory, the page says that too.

Free includes 3 manual live checks and does not schedule them. Pro checks each endpoint once a day. Team checks once a day. Certwatch does not install the newer certificate. It only reports the difference. Pro and Team can be alerted when that difference appears.

What this will not catch

If the renewal was never logged, or it expired before Certwatch stored any row for the domain, there is nothing later to compare against. A host that is not in the endpoint list is not checked. The log inventory and the expiry view still only describe issued certificates.