Features
Expiry monitoring on any TLS port, an eight-part health score, Certificate Transparency alerts, Slack and Teams webhooks, a REST API and CSV bulk import.
CertWatchr is an SSL/TLS certificate monitoring service. You give it the hostnames you care about; it reads their certificates on a schedule, scores how healthy each one is, watches the public logs for certificates you did not issue, and tells you before anything breaks.
Agencies, freelancers and DevOps teams use it to monitor SSL certificates for their customers and across many projects, from staging to production. Tags and filters keep it organised, and CSV import makes onboarding a new customer a one-minute job.
This page is the full list. To get going, start with Getting started.
Certificate expiry monitoring
The core job: connect to each hostname:port, read the certificate the server actually serves,
and track how long it has left.
- Any host and port, not only
:443. Mail servers, APIs and internal services work the same way — including ports that start in plaintext and upgrade with STARTTLS (587,25,143,110) as well as the always-encrypted ones (993,465,995). See Adding domains. - Issuer, subject, validity period and days remaining, refreshed on every check.
- A status per domain — OK, Warning, Critical, Error, or Untested before the first check — and a per-domain alert threshold so each certificate warns you as early as you need.
- Failed checks are retried before you are told, so a brief network problem does not become an alert, and errors are reported as plain causes: DNS failure, connection refused, handshake failed, hostname mismatch.
Check schedule
| Frequency | Behaviour |
|---|---|
| Daily | The default |
| Weekly | Once every seven days |
| Custom (Pro) | A cron expression you supply |
Certificate health score
A certificate that is merely valid can still be a problem. Every check also produces a 0–100 health score built from eight sub-checks, so you can see why a score is what it is:
| Check | Points | What it means |
|---|---|---|
| Chain trusted | 20 | Issued by a CA browsers trust. Fatal |
| Expiry proximity | 20 | How much of the certificate's own lifetime is left |
| Hostname match | 15 | The certificate covers the hostname you monitor. Fatal |
| Chain complete | 10 | The server sends its intermediates, not only its own certificate |
| Revocation | 10 | Not on the issuer's revocation list. Fatal |
| TLS version | 10 | TLS 1.2 / 1.3 in use, and 1.0 / 1.1 no longer accepted |
| Signature & key | 10 | SHA-256 or stronger, over RSA ≥2048 or EC ≥256 |
| Not yet valid | 5 | The certificate's start date has passed. Fatal |
A fatal problem means no browser will open the site, so it caps the score at 20 rather than just costing its points. The domain page shows the breakdown, a what to fix list ordered by urgency, and a chart of the score over time, so you can see a configuration change land. Full detail in Health score.
Certificate Transparency monitoring
Every publicly trusted certificate is published to Certificate Transparency logs. CertWatchr watches them for your hostnames and alerts you when a certificate appears that it has not seen before — which a check of your own server can never catch:
- A certificate mis-issued for your domain.
- A team issuing a certificate for a hostname you own, outside your process.
- A certificate for a hostname you no longer control.
Several new certificates in a day collapse into one notification. See CT log monitoring.
Alerts and notifications
Five alerts: expiry warning, expiry critical, certificate changed, check error, and new certificate in CT log.
- E-mail, on from the start.
- Webhooks (Pro): every alert posted to a URL you control, as plain JSON or formatted for Slack or Microsoft Teams, with a test button that sends a sample.
- No repeats: one alert of each kind per domain per day, however often the check runs.
- Snooze: mute one domain for 1–30 days while a planned renewal or migration happens. Checks keep running.
- Summary e-mail: an optional daily or weekly roll-up of everything you monitor.
- Alert history: every alert ever sent, filterable, with delivery status — a failed webhook shows its HTTP status and error.
See Alerts & notifications and Webhooks.
Organising many domains
- Labels: a human-readable name per domain, shown in tables and alerts.
- Tags:
prod,customer-a, anything — click one to filter. - Search across hostname and label, and a status filter for "what needs attention".
- CSV import and export: onboard a customer with one file; bad rows are reported, not fatal.
See Monitoring certificates for customers and projects.
REST API
List, add and delete domains, trigger checks, and read health scores and history, from your own scripts and CI. Token authentication with a token you can rotate yourself. From Starter up. See the API reference.
Dashboard and account
- Domain list with status, days remaining and a health sparkline per domain.
- Domain page with certificate details, health breakdown, score history and recent alerts.
- Light and dark themes; interface in English or German.
- Two-factor authentication with any authenticator app, plus recovery codes.
- Sign in with Google, GitHub or Microsoft, where the deployment offers it.
- Delete your account and everything in it yourself, in one step.
What it does not do
- It does not renew certificates. It tells you to; tools like certbot do the renewing.
- It does not monitor uptime or response times. It is about certificates, not availability.
- It cannot check hosts it cannot reach. Checks run from CertWatchr's servers, so the host must be reachable from the internet on the port you give it.
Plans
Free covers 3 domains with expiry monitoring and e-mail alerts. Health scoring, CT monitoring and the REST API start at Starter; webhooks and custom schedules are Pro. Full breakdown on Plans & limits.