Stop getting paged
at 2am for
expired certs
The complete certificate intelligence platform. Monitor SSL certificates, discover subdomains, track uptime from 20 global regions — all in one place.
| HOSTNAME | EXPIRES | DAYS | STATUS | SOURCE |
|---|---|---|---|---|
| api.example.com | Mar 15, 2026 | 52 | ● valid | public |
| dashboard.internal | Feb 28, 2026 | 37 | ● valid | agent |
| db.cluster.local | Feb 03, 2026 | 12 | ● expiring | k8s |
| *.example.com | Jun 20, 2026 | 149 | ● valid | public |
Your certificate mission control
One platform for certificate monitoring, subdomain discovery, and global uptime tracking.
Monitor SSL certificates across public domains, private networks, and Kubernetes clusters.
| DOMAIN | STATUS | DAYS |
|---|---|---|
| api.example.com | ● valid | 52 |
| dashboard.internal | ● valid | 37 |
| db.cluster.local | ● expiring | 12 |
Monitor what others can't reach
Public domains, private networks, or Kubernetes clusters. Pick your method—or use all three.
Add any public domain. We check certificates from our global edge nodes every 5 minutes.
The only SSL monitor that speaks
cert-manager natively
Auto-discover Certificate CRDs. Detect stuck ACME challenges. Monitor the full cert-manager lifecycle—not just TLS secrets.
Other SSL Monitors
CertWatch
| NAMESPACE | NAME | READY | SECRET | AGE | CERTWATCH |
|---|---|---|---|---|---|
| production | api-tls | True | api-tls-secret | 45d | ● monitored |
| staging | web-tls | True | web-tls-secret | 12d | ● monitored |
| production | db-tls | False | db-tls-secret | 8h | ⚠ challenge stuck |
Monitor from everywhere,
not just one datacenter
Your users are global. Your monitoring should be too. Check SSL health and uptime from 20 edge locations simultaneously.
Available now: Beta users get instant access to 4 edge locations (US-East, US-West, EU-West, Asia-South) via our uptime checker tool while we build out all 20 regions.
20 edge locations
Monitor from North America, Europe, Asia Pacific, South America, and Africa.
60-second intervals
Check certificates and uptime every minute from all regions simultaneously.
Regional latency tracking
Identify slow regions and geographic-specific SSL issues.
CDN cache warming
Free bonus: keep your CDN cache warm with regular edge requests.
See every certificate
issued for your domains
Certificate Transparency logs are public. We watch them for you. Know instantly when anyone issues a certificate for your domain—even subdomains you didn't know existed.
Subdomain discovery
Find certificates for subdomains you didn't know existed. CT logs reveal all.
Real-time alerts
Know within minutes when new certificates are issued for your domains.
Shadow IT detection
Discover rogue services deployed without approval. Catch them before they become problems.
Complete audit trail
Full inventory of all certificates ever issued for your domains. Nothing hidden.
Alerts where your team works
Get notified in the tools you already use. No context switching, no missed alerts.
Slack
LIVEReal-time alerts in your workspace
PagerDuty
LIVEIncident management integration
Notifications to any address
Webhooks
LIVECustom HTTP callbacks
Discord
SOONAlerts in your Discord server
Microsoft Teams
SOONAlerts in Teams channels
Phone/SMS
SOONCritical alerts via phone
Everything you need
No fluff. Just the features that prevent 2am pages.
Full chain validation
Validate entire certificate chains from leaf to root. Detect missing intermediates, expired certs, and self-signed issues.
Revocation checking
OCSP and CRL verification. Know if certificates are revoked before they cause issues.
5-minute intervals
Check certificates as frequently as every 5 minutes. Customizable alert thresholds at 30, 14, 7, or 1 day.
Multi-channel alerts
Slack, PagerDuty, Email, and Webhooks. Get notified where your team already works.
Prometheus metrics
Expose certificate metrics to Prometheus. Days until expiry, validity status, chain health.
Weak crypto detection
Detect weak RSA keys (<2048 bit), deprecated SHA1 signatures, and other security vulnerabilities.
┌─────────────────────────────────────────┐ │ More features shipping every sprint. │ │ Request yours at github.com/certwatch │ └─────────────────────────────────────────┘
Stop fighting with spreadsheets
and cron jobs
See how DevOps teams evolved from manual tracking to automated certificate monitoring.
Manual Tracking
Spreadsheets & calendar reminders
| Domain | Expires | Renewed? | Notes |
|---|---|---|---|
| api.example.com | Mar 15, 2026 | ☐ | ... |
| db.internal | Jan 18, 2026 | ✗ | EXPIRED! |
DIY Scripts
Cron jobs with curl & openssl
# /etc/cron.d/check-certs
*/30 * * * * /opt/scripts/check-certs.sh
# check-certs.sh
echo | openssl s_client -connect api.example.com:443 \
2>/dev/null | openssl x509 -noout -dates | grep...
# ❌ Breaks when openssl output format changes
# ❌ Can't reach internal.db behind firewall
# ❌ No retry logic, no proper alertingOther SSL Monitors
Public-only monitoring services
# Other monitors can only scan public domains $ curl https://api.sslmonitor.com/check -d domain=internal.database.local Error: Domain not publicly accessible # ❌ Your private infrastructure is invisible
CertWatch
The complete solution
# Deploy in 2 minutes $ docker run -d cw-agent -e CW_API_KEY="your-key" ✓ Auto-discovered 47 certificates ✓ Monitoring public + private endpoints ✓ cert-manager integration active ✓ Prometheus metrics on :8080 # Zero maintenance. Just works.
Questions
Deploy our lightweight Docker agent inside your network. It pushes certificate data outbound—no inbound firewall rules needed. The agent is only 15MB and includes Prometheus metrics.
Start monitoring in
under 2 minutes
No credit card required. Help us shape the product and get early adopter perks when we launch.
Built by engineers who've been paged at 2am one too many times.