CertWatch documentation
CertWatch is a focused TLS certificate and domain-renewal monitor for small engineering teams, consultants, and agencies. It opens a raw TLS connection against any host:port you give it — not just web servers — so it covers APIs, mail servers, databases, or anything else terminating TLS, then alerts you before an expiring certificate or a lapsing domain registration becomes an outage.
Start with the problem
Certificates and domain registrations fail quietly until a client, browser, mail server, or customer is the first one to notice. Why monitor? explains the failure modes and what external monitoring can and cannot prove. If you are diagnosing one target right now, start with the free tools instead.
What CertWatch monitors
Two related but separate things, both included on every plan:
-
TLS endpoints — a
host:portyou register. CertWatch dials it on a schedule and checks certificate expiry, chain validity, and issuer/subject identity, alerting on an unexpected change (a silent reissuance or swap can signal a broken deploy or a compromised certificate, not just an expiry countdown). -
Domains — a registrable domain name (e.g.
example.com). CertWatch checks its own expiry and registration signals (transfer lock, DNSSEC, exposed registrant contact) via RDAP, independent of any certificate served on it.
Where to start
- Why monitor? — the operational case for certificate and domain monitoring.
- Free tools — check a live endpoint, decode a certificate, or inspect it locally.
- Setup — creating an account and adding your first endpoint or domain.
- API — the session-based HTTP/JSON API behind the dashboard.
- Monitoring behavior — check intervals, statuses, and history.
- Alerts — channels, delivery, and what a real alert looks like.
- Troubleshooting — interpret failures and decide what to do next.
- Billing — plans, limits, and how upgrades/downgrades work.
- Deployment — how CertWatch itself is hosted and released.
- Trust & security — data handling and how we monitor our own monitor.