FAQ

Q: Registration email didn't arrive

Check your spam folder. The sender is noreply@certwatchr.com. Check the address. On the sign-in page, try Forgot password?. If the address is unknown, you probably mistyped it — register again. Still nothing? Write to us via the support page and we confirm the account for you.

Q: How often are certificates checked?

Expiry: once a day. Per domain you can choose daily, weekly or (Pro) your own schedule. Health score: every 30 minutes, and whenever you click ↻ on the domain page. Certificate Transparency logs: once an hour. Domain registration: once a week, and daily in the weeks before it expires.

Q: How many days before expiry should I be warned?

30 days suits most certificates. Let's Encrypt renews 90-day certificates at 30 days left, so a warning then tells you the moment a renewal fails, with weeks to fix it. Much more than 45 days and the warning comes before renewal was even tried — you learn to ignore it. You can set it per domain, e.g. 45 for a customer's shop and 14 for a staging host.

Q: Where do I get an API token?

Settings → API token, on Starter and Pro. Send it in the Authentication-Token header. See the API.

Q: Can several people share one account?

Yes, on the Team plan, for three people or more. Under Settings → Team, invite colleagues by e-mail. They see and manage the same domains and each get every alert, but keep their own login, password and settings. Nobody shares a password, and when someone leaves you remove just them. See Teams.

Q: How do I upgrade my plan?

Go to Settings → Plan & billing and choose Starter or Pro. The new plan is active as soon as the payment goes through. To change it later, use Manage subscription on the same page. See Plans & limits.

Why a renewed certificate still shows as expired, what to do now Let's Encrypt has stopped sending expiry e-mails, and what each CertWatchr alert means.

Registration email didn't arrive

Check your spam folder. The sender is noreply@certwatchr.com.
Check the address. On the sign-in page, try Forgot password?. If the address is unknown, you probably mistyped it — register again.
Still nothing? Write to us via the support page and we confirm the account for you.

How often are certificates checked?

Expiry: once a day. Per domain you can choose daily, weekly or (Pro) your own schedule.
Health score: every 30 minutes, and whenever you click ↻ on the domain page.
Certificate Transparency logs: once an hour.
Domain registration: once a week, and daily in the weeks before it expires.

Can I monitor ports other than 443?

Yes, any port. That includes mail servers: encrypted from the start (IMAPS 993, SMTPS 465, POP3S 995) or upgraded with STARTTLS (SMTP 587 and 25, IMAP 143, POP3 110). Add mail.example.com on port 587 just like a website. See Adding domains.

How many days before expiry should I be warned?

30 days suits most certificates. Let's Encrypt renews 90-day certificates at 30 days left, so a warning then tells you the moment a renewal fails, with weeks to fix it. Much more than 45 days and the warning comes before renewal was even tried — you learn to ignore it. You can set it per domain, e.g. 45 for a customer's shop and 14 for a staging host.

Why is my health score below 100 when the site works?

Because the score checks more than "it opens in my browser": a trusted chain, the right hostname, the intermediate certificates, old TLS versions, key strength and revocation.

Four problems are fatal — browsers refuse the site — and cap the score at 20. That is why a self-signed certificate scores 20, not 90. The domain page lists what to fix, most urgent first. Points per check: Health score.

What's a Certificate Transparency log?

A public record of every certificate a trusted CA issues. CAs must publish there, which is how CertWatchr can tell you when someone gets a certificate for your hostname. See CT log monitoring.

Where do I get an API token?

Settings → API token, on Starter and Pro. Send it in the Authentication-Token header. See the API.

Yes, on the Team plan, for three people or more. Under Settings → Team, invite colleagues by e-mail. They see and manage the same domains and each get every alert, but keep their own login, password and settings. Nobody shares a password, and when someone leaves you remove just them. See Teams.

How do I upgrade my plan?

Go to Settings → Plan & billing and choose Starter or Pro. The new plan is active as soon as the payment goes through. To change it later, use Manage subscription on the same page. See Plans & limits.

What happens to my domains if I cancel?

Nothing is deleted. When the paid period ends, the account moves to Free. All domains keep being checked, but webhooks, the API, CT monitoring and client report links stop. Subscribe again and everything is back.

Why was I signed out?

A sign-in lasts 12 hours from the moment you log in, even if you are working the whole time. Then the sign-in page tells you that your session has expired. That way a forgotten browser tab or a shared computer does not stay signed in for ever. Just sign in again — scripts using an API token are not affected.

Where is my data hosted?

In the EU. The application, the database and the queue all run on EU infrastructure. The security page names the provider and country; the privacy policy lists every processor with its location.

The checks themselves connect to wherever your hosts are. We keep only the certificate details that come back.

Let's Encrypt stopped sending expiry emails — what do I use instead?

Let's Encrypt stopped its expiry e-mails on 4 June 2025. Since then, a renewal that quietly fails ends in an expired certificate without any warning.

Let's Encrypt recommends automating renewal and monitoring from outside, because the two fail independently. CertWatchr is the outside part: add the hostname, keep the 30-day threshold, and you get the warning Let's Encrypt used to send.

My certificate renewed, but the browser still shows the old one

Almost always, the renewal worked but the server was not reloaded. Certbot writes the new files, but nginx, Apache, Postfix or the load balancer keeps serving the old certificate until it re-reads them.

CertWatchr reads what is actually served, so it shows the old certificate too. Reload the service, then click Check now on the domain page.

Certbot renewal failed and nothing warned me

Renewal can fail in three places:

The timer never ran — the systemd timer or cron job is off, or the host was down.
Validation failed — port 80 is closed, a redirect blocks /.well-known/, or DNS points elsewhere. The old certificate keeps working until it expires, so nobody notices.
Nothing reloaded — see the previous answer.

sudo certbot renew --dry-run safely reproduces the first two. The reason is in /var/log/letsencrypt/letsencrypt.log. CertWatchr's expiry warning catches all three, because it checks what the server serves right now.

What actually happens when a certificate expires?

Every browser stops visitors with a full-page warning — NET::ERR_CERT_DATE_INVALID in Chrome, "Warning: Potential Security Risk Ahead" in Firefox. Most people turn back, and search engines treat the site as down.

It is not only the website. Everything using that certificate breaks at the same moment: mail on 587 or 993, API clients, mobile apps, webhooks you send to others. Those often fail without anyone noticing straight away.

What do the browser certificate errors mean?

Error	What it means	Where CertWatchr shows it
`NET::ERR_CERT_DATE_INVALID`	Expired, or not yet valid — check the clocks	Expiry alert; `not_yet_valid` sub-score
`NET::ERR_CERT_AUTHORITY_INVALID`	Self-signed, or from a CA the client does not trust	`chain_trusted` sub-score, fatal
`NET::ERR_CERT_COMMON_NAME_INVALID`	The hostname is not in the certificate	`hostname_match` sub-score, fatal
`SSL_ERROR_BAD_CERT_DOMAIN`	Firefox's name for the same mismatch	`hostname_match` sub-score, fatal
"incomplete chain" in an SSL test	Intermediates missing; works in some browsers, not others	`chain_complete` sub-score

My question isn't here

Contact support. The form works whether or not you are signed in.