What it is
A free certificate checker that connects to your hosts over TLS, the same way a browser does, and reads what the server actually presents. It works for websites and for mail and other TLS ports.
TLS certificate watch
Know how many days your certificate has left, before your users do.
Enter up to ten hostnames. Cert Watch opens a real TLS connection to each one and shows the days left, the issuer, the names covered, the chain and anything that will make browsers complain. Add a calendar reminder for the renewal and keep a receipt for the team.
- Expiry
- Names covered
- Chain
Who it is for
Indie founders, small ops teams, freelancers who look after client sites, and anyone who has lived through an expired certificate on a Friday night.
The problem it solves
Automatic renewal fails quietly: a DNS change, a moved server, a forgotten staging host. The first sign is usually a customer screenshot. Here you see the countdown, the cause and the fix before that happens.
Check hosts
Each host is checked live from our server. Only public hosts are allowed and nothing is stored.
One per line or separated by spaces, up to ten. Add a port for mail and other services, like mail.example.com:993.
No check yet
Enter your own hostnames, or load the demo to see every kind of result.
Read a certificate
Six fields explain almost every certificate incident.
Expires
The hard deadline. Public certificates now last 90 days to a year, so renewal must be automatic.
Names covered
The exact hostnames the certificate is valid for. www and the bare domain are different names.
Issuer
The authority that signed it. A surprise issuer can mean someone else set up the host.
Chain
The path from your certificate to a trusted root. A missing middle link breaks some clients only.
Key
RSA keys need 2048 bits or more. EC keys are shorter and just as strong.
Connection
The TLS version agreed. TLS 1.2 and 1.3 are the ones to keep.
How to use
List your hosts
Include the bare domain, www, the API, the status page and any mail host. Forgotten hosts expire first.
Run the check
Each host is contacted live. Results are sorted with the most urgent first.
Fix what is red
Every problem comes with the exact fix. Missing names and chains are the usual surprises.
Set reminders
Download calendar reminders two weeks before each expiry and paste the receipt in your checklist.
Good to know
- Up to ten hosts per check, on ports 443, 8443, 465, 993, 995, 636, 853 and 5223.
- Private, local and internal addresses are refused on purpose.
- Hosts behind several servers may present different certificates. This shows the one we reached.
- Revocation is not checked.
Questions
Is anything stored?
No. Hostnames are used for the live check only and the results stay in your browser.
Why does my browser say fine when this says the chain is missing?
Desktop browsers often fill the gap from a cache. Phones, scripts and payment providers often do not.
Can it renew my certificate?
No. Renewal happens on your server or hosting provider. This shows when and why it is needed.
How early should I renew?
Automatic renewal usually runs 30 days before expiry. If you are under 14 days, something is wrong.