FAQ

Registration email didn't arrive

Check, in this order:

1. Your spam folder. The sender is noreply@certwatchr.com.
2. The address you typed. Open the sign-in page and try Forgot password? — if the address is unknown, you probably registered with a typo. Register again with the right one.
3. Still nothing? Write to us through the support page and we will confirm the account for you.

How often are certificates checked?

• Certificate expiry: once a day. Per domain you can choose daily, weekly or (Pro) your own cron schedule.
• Health score: every 30 minutes, plus whenever you press ↻ on the domain page.
• Certificate Transparency logs: once an hour.

Can I monitor ports other than 443?

Yes — any port. Mail ports work whether they are encrypted from the start (IMAPS 993, SMTPS 465, POP3S 995) or start in plaintext and upgrade with STARTTLS (SMTP 587 and 25, IMAP 143, POP3 110). Add mail.example.com on port 587 exactly as you would a website. See Adding domains.

How many days before expiry should I be warned?

Long enough to fix it in working hours. 30 days, the default, suits a 90-day Let's Encrypt certificate: automatic renewal starts at 30 days, so a warning at that point means you find out the moment a renewal fails, with weeks to spare. Much beyond 45 days the warning arrives before renewal has even been tried and you learn to ignore it. Set it per domain — a customer's production site can have 45 while a staging host has 14.

Why is my health score below 100 when the site works?

Because "it opens in my browser" is a lower bar than the score measures. It also checks whether the chain is trusted, whether the certificate really covers the hostname, whether the server sends its intermediates, whether TLS 1.0/1.1 are still accepted, how strong the key and signature are, and whether the certificate has been revoked.

Four of those are fatal — no browser will open the site — and cap the score at 20, which is why a self-signed certificate scores 20 and not 90. The domain page lists what to fix, most urgent first; the points for each check are on the health score page.

What's a Certificate Transparency log?

A public, append-only record of every certificate any browser-trusted CA issues. Browsers require CAs to publish there, which is what lets CertWatchr tell you when a certificate for your hostname appears that you didn't issue. See CT log monitoring.

Where do I get an API token?

Settings → API token, on Starter and Pro accounts. Send it in the Authentication-Token header. See the API.

How do I upgrade my plan?

Billing, then pick Starter or Pro. The new plan is active as soon as the payment goes through. To change plan later, use Billing → Manage subscription. See Plans & limits.

What happens to my domains if I cancel?

Nothing is deleted. At the end of the paid period the account returns to Free: domains above the free limit keep being checked, but webhooks, the API and CT monitoring stop. Subscribe again and everything is where you left it.

Where is my data hosted?

In the EU. The application, the database and the queue all run on EU infrastructure and nothing is copied outside it. The security page names the provider and country, and the privacy policy lists every processor with its location.

The checks themselves connect to whatever host you ask us to monitor, wherever it is. What we keep is the certificate details that come back.

Let's Encrypt stopped sending expiry emails — what do I use instead?

Let's Encrypt ended its expiry notification e-mails on 4 June 2025. Nothing replaced them: a renewal that quietly stops working now expires in silence.

Let's Encrypt's own advice is to automate renewal and monitor from outside, because the two fail independently. CertWatchr is the outside half: it reads the certificate your server actually serves, so it sees what your visitors see. Add the hostname, keep the 30-day threshold, and you get the warning Let's Encrypt used to send.

My certificate renewed, but the browser still shows the old one

Almost always the renewal worked and nothing reloaded the web server. Certbot writes the new files, but nginx, Apache, Postfix or the load balancer in front keeps serving the certificate it read at start-up until it is told to re-read.

That is exactly what CertWatchr sees: it reads what is served, so a stale certificate still in memory shows up as one about to expire. Reload the service (not the renewal) and re-check from the domain page.

Certbot renewal failed and nothing warned me

Renewal can break in three places, and only the last is visible on the site:

1. The timer never ran — the systemd timer or cron entry is off, or the host was down.
2. Validation failed — port 80 closed, a redirect swallowing the /.well-known/ challenge, or DNS pointing elsewhere. The old certificate keeps working until it expires, so there is no symptom until there is.
3. Nothing reloaded — see the previous answer.

sudo certbot renew --dry-run reproduces the first two safely; the real reason is in /var/log/letsencrypt/letsencrypt.log. An expiry warning from CertWatchr covers all three, because it asks the only question that matters: what is the server serving right now?

What actually happens when a certificate expires?

Every browser stops the visitor with a full-page warning — NET::ERR_CERT_DATE_INVALID in Chrome, "Warning: Potential Security Risk Ahead" in Firefox — that most people will not click through, and search engines treat as an outage.

It is not only the website. Anything using TLS breaks at the same moment: mail delivery on 587 or 993, API clients, mobile apps, and webhooks you send to other people. Those usually fail more quietly than the site does.

What do the browser certificate errors mean?

Error	What it means	Where CertWatchr shows it
NET::ERR_CERT_DATE_INVALID	Expired, or not yet valid — check the clock at both ends	Expiry alert; not_yet_valid sub-score
NET::ERR_CERT_AUTHORITY_INVALID	Self-signed, or issued by a CA the client does not trust	chain_trusted sub-score, fatal
NET::ERR_CERT_COMMON_NAME_INVALID	The hostname is not in the certificate	hostname_match sub-score, fatal
SSL_ERROR_BAD_CERT_DOMAIN	Firefox's wording for the same mismatch	hostname_match sub-score, fatal
"incomplete chain" in an SSL test	Intermediates missing; works in some browsers, not others	chain_complete sub-score

The last one is the sneakiest: a missing intermediate works in a browser that has cached it, so whoever set up the server sees a working site while other people cannot connect.

My question isn't here

Contact support. The form works whether or not you are logged in.