Features

CertWatchr is an SSL/TLS certificate monitoring service. You add your hostnames. CertWatchr checks their certificates on a schedule, scores them, watches the public logs, and warns you before anything breaks.

Agencies, freelancers and DevOps teams use it to monitor SSL certificates for their customers across many projects. Want to try it? Start with Getting started.

Certificate expiry monitoring

CertWatchr connects to each hostname:port, reads the certificate the server actually serves, and tracks how many days it has left.

• Any port. Websites on 443, mail servers on 587, 25, 143, 110 (STARTTLS) or 993, 465, 995, and any other TLS service. See Adding domains.
• One status per domain: OK, Warning, Critical, Error, or Untested before the first check.
• Your own warning time per domain — 30 days before expiry, or whatever suits you.
• No false alarms. A failed check is retried for about half an hour before you hear about it, and the error is named plainly: DNS failure, connection refused, hostname mismatch.

Check schedule
Daily	The default
Weekly	Once every seven days
Custom (Pro)	Your own cron expression

Beyond the expiry date

Most certificates expire because a renewal quietly stopped working, not because nobody planned one. So CertWatchr also checks whether the next certificate will arrive:

• Renewal overdue — a short-lived certificate is still served after automatic renewal should have replaced it. Usually certbot, acme.sh or cert-manager has broken. You hear about it weeks before the expiry warning.
• CAA — your DNS CAA records would refuse the CA that issued your certificate, so its next renewal would fail.
• Every address behind a hostname — when a name points to several servers, each is checked. You are warned if one serves a different certificate.
• Domain registration — the domain itself is about to expire at the registrar. Works for .com, .net, .org and most generic TLDs; .de, .at, .ch and .eu publish no expiry date.

Certificate health score

Valid is not the same as healthy. Every certificate gets a 0–100 health score from eight sub-checks:

Check	Points	What it means
Chain trusted	20	Issued by a CA browsers trust. Fatal
Expiry proximity	20	How much of the certificate's lifetime is left
Hostname match	15	The certificate covers your hostname. Fatal
Chain complete	10	The server sends its intermediate certificates
Revocation	10	Not revoked by the issuer. Fatal
TLS version	10	TLS 1.2 or 1.3, with 1.0 and 1.1 switched off
Signature & key	10	SHA-256 or better, RSA ≥2048 or EC ≥256
Not yet valid	5	The start date has passed. Fatal

A fatal problem means browsers refuse the site, so it caps the score at 20. The domain page shows what to fix, most urgent first, and how the score changed over time. Details: Health score.

Certificate Transparency monitoring

Every public certificate is published in Certificate Transparency logs. CertWatchr watches them and tells you when a new certificate appears for your hostname — for example one issued by mistake, by another team, or by someone who should not have one.

• Several new certificates on one day mean one alert, not several.
• Wildcard certificates that cover your hostname count. Optionally, every name below it counts too.
• Hostnames under your domain that you do not monitor yet are suggested, ready to add with one click.

See CT log monitoring.

Alerts and notifications

Nine alerts: expiry warning, expiry critical, renewal overdue, CAA blocks your CA, domain registration expiring, servers disagree, certificate renewed or changed, check failed, and new certificate in CT logs. What each one means: Alerts & notifications.

• E-mail — on from the start.
• Notification centre (Starter and Pro) — a bell in the header with everything still open; warnings disappear by themselves once fixed. See Notification centre.
• Webhooks (Pro and Team) — up to 10 on Pro and 25 on Team, each in its own format: JSON, Slack, Microsoft Teams, Discord, Mattermost or Telegram. A test button sends a sample.
• No repeats — at most one alert of each kind per domain per day (per week for renewal overdue and CAA).
• Snooze — mute one domain for 1 to 30 days during a planned renewal. Checks keep running.
• Summary e-mail — an optional daily or weekly overview.
• Alert history — every alert sent, with its delivery status.

See Alerts & notifications and Webhooks.

Organising many domains

• Labels — a readable name per domain, shown in every table and alert.
• Tags — prod, customer-a, anything. Click one to filter.
• Search and status filter — find a domain, or show only what needs attention.
• CSV import and export (Starter and Pro) — onboard a customer with one file.
• Client reports (Pro) — a read-only link that shows one customer their certificates, no login needed.

See Monitoring certificates for customers and projects.

Teams

On the Team plan — every Pro feature, billed per person, from three people — invite your colleagues to your account.

• Everyone sees and manages the same domains.
• Every alert reaches everyone by e-mail, each with their own notification settings. The team's webhooks are yours.
• Everyone keeps their own login and two-factor authentication. Plan and billing stay with you.
• Roles: admins invite people, members work on the domains, viewers only look.
• Activity log: see who added, changed, snoozed or deleted what.

So a warning never sits in the inbox of someone on holiday. See Teams.

REST API

List, add and delete domains, start checks, and read health scores from your own scripts or CI. Token authentication, from Starter up. See the API reference.

Dashboard and account

• Domain list with status, days left and a small health chart per domain.
• A page per domain with certificate details, health breakdown, history and recent alerts.
• Light and dark theme; English or German.
• Two-factor authentication with any authenticator app.
• Sign in with Google, GitHub or Microsoft, where offered.
• A sign-in lasts 12 hours; then you sign in again. API tokens are not affected.
• Delete your account yourself, in one step. If you ever paid, only the billing record is kept, for as long as the law requires.

What CertWatchr does not do

• Renew certificates. It reminds you; certbot and similar tools do the renewing.
• Monitor uptime. It checks certificates, not response times.
• Reach private hosts. Checks run from CertWatchr's servers, so the host must be reachable from the internet.

Plans

Free covers 3 domains with expiry monitoring and e-mail alerts. Starter adds the health score, CT monitoring and the API. Pro adds webhooks, custom schedules and client reports. Full comparison: Plans & limits.