Adding domains

Monitor certificates on 443, on IMAPS 993 and SMTPS 465, and on the plaintext mail ports that upgrade with STARTTLS: 587, 25, 143 and 110.

Go to Domains → Add domain. Only the hostname is required; everything else has a sensible default and can be changed later.

The form

Hostname

The DNS name to connect to, e.g. example.com or api.example.com. No scheme (https://) and no path. The hostname cannot be changed after saving — to monitor a different name, add it as a new domain.

Port

Defaults to 443 (HTTPS). Any port that serves TLS works:

Service Port Notes
HTTPS 443 The default
IMAPS / SMTPS / POP3S 993 / 465 / 995 Encrypted from the first byte
SMTP submission / SMTP / IMAP / POP3 587 / 25 / 143 / 110 Start in plaintext and upgrade with STARTTLS — CertWatchr does the upgrade for you
Anything else 1–65535 Internal HTTPS ports, APIs, and so on

So a mail server is added exactly like a website: mail.example.com, port 587. Which protocol is used is decided by the port number. If your server runs a mail service on an unusual port, or speaks encrypted-from-the-start TLS on 587, the check reports STARTTLS upgrade failed rather than a certificate problem.

Label

Optional, up to 128 characters. Shown next to the hostname in every table and in every alert. Use it for the customer, project or purpose: "Acme – shop", "staging", "internal admin".

Tags

Optional, comma-separated, up to ten per domain: prod, customer-a, web. Tags are lowercased and de-duplicated for you, so Prod, Web and web,prod are the same. Click a tag on the domain list to see only the domains carrying it.

Alert threshold (days before expiry)

How many days ahead you want the first warning. What happens as expiry approaches:

  • More days left than the threshold → status OK, nothing sent.
  • Within the threshold → status Warning, an expiry warning is sent.
  • 7 days or fewer → status Critical, a more urgent expiry critical alert is sent.

On Free the threshold is fixed at 30 days — the field is shown but not editable, so there is nothing to decide. Starter and Pro can set anything from 1 to 365 days: a short threshold is quieter and suits a certificate that renews every 90 days automatically, a long one gives you room when a renewal needs a purchase order.

Check frequency (on the edit page)

  • Daily: the default.
  • Weekly: checked once every seven days.
  • Custom (Pro): a cron expression, e.g. 0 6 * * 1-5 for weekdays at 06:00. Custom schedules are evaluated in UTC.

What happens after you save

  1. The first check runs about two minutes after saving, so you have a moment to add a label or adjust the threshold first.
  2. When it completes, the domain's page shows the issuer, subject, expiry date, days remaining and status. Starter and Pro accounts also get a health score shortly after.
  3. From then on the certificate is re-read on the schedule you chose.

If the host cannot be reached, the status shows Error straight away. The check is retried a few times over the following half hour before a check error alert is sent, so a brief network blip does not e-mail you.

Editing a domain

Open the domain and click Edit. You can change the port, label, tags, alert threshold and check frequency. To change the hostname, delete the domain and add it again.

Finding a domain

The filter bar above the domain list has three controls that combine and stay in effect while you page through results:

  • Search matches any part of the hostname or label, ignoring case.
  • Status narrows to OK, warning, critical, error or untested.
  • Tag narrows to one tag.

Import and export

Both are in the dropdown next to Add domain.

Export downloads everything you monitor as a CSV file, including the latest check results.

Import takes a CSV file with a header row. Only hostname is required; port, label, tags, alert_at_days, check_frequency and check_cron are used if present, and any other columns are ignored — so a file you exported can be imported straight back.

hostname,port,label,tags,alert_at_days
example.com,443,Main site,"prod,web",30
api.example.com,8443,API,prod,14

One bad row does not stop the others. After the import you get a report listing, separately, rows with an invalid hostname or port, domains you were already monitoring, and duplicates within the file. Your plan still applies: the import stops when you reach your domain limit, a threshold above your plan's maximum is lowered to it, and a custom schedule on a non-Pro account becomes daily — the row is still imported. Files are limited to 1,000 rows.

Plan limits at a glance

Plan Max domains Alert threshold Custom schedule
Free 3 fixed at 30 days –
Starter 50 1–365 days –
Pro unlimited 1–365 days ✅

See Plans & limits for everything each plan includes.