Guides
What changed, what breaks, and how to check.
Written for people who look after other people's websites. Every guide links the primary sources it relies on.
- 015 min
47-day SSL certificates: the schedule and what agencies should do
Public TLS certificates drop from 398 days to 47 by March 2029. The exact dates, what changes for agencies, and a checklist to get ready.
- 025 min
Let's Encrypt no longer sends expiry emails. What to do instead
Let's Encrypt stopped sending expiry notification emails on 4 June 2025. Why it stopped, what to use instead, and how to spot a failed renewal early.
- 035 min
ACME Renewal Information (ARI): how renewal windows work
ARI (RFC 9773) lets a CA tell ACME clients when to renew. How the renewal window and certID work, which clients support it, and how to query it.
- 045 min
How to check an SSL certificate's expiration date
Check when an SSL certificate expires with a browser, openssl, curl or PowerShell, check many hosts at once, and avoid the SNI and chain mistakes.
- 055 min
Domain expiry monitoring: what really happens when a domain lapses
How gTLD domains expire, the grace and redemption periods ICANN requires, RDAP instead of WHOIS, and a checklist for agencies holding client domains.
- 065 min
What happens when an SSL certificate expires
What browsers, APIs, mobile apps and mail servers do when a TLS certificate expires, two outages with primary sources, and how to recover and prevent it.
- 075 min
Find every subdomain with Certificate Transparency logs
Every publicly trusted certificate is logged in public CT logs. How to search them with crt.sh and Cert Spotter, and what agencies should do with the results.
- 084 min
SSL monitoring for agencies: a playbook for 20 to 500 client sites
Inventory, renewal ownership, ACME, shrinking certificate lifetimes, alert routing and client reporting, for agencies looking after 20 to 500 client sites.
Start with five domains, free.
The free plan watches 5 domains for one client: certificates, domain registration, DNS and uptime every 15 minutes. No card, no trial clock.