Certificate monitoring

Every certificate hostnag can reach is watched for expiry, a swapped chain and a renewal that should already have happened; the ones it cannot reach get a URL to report to instead.

Start free See pricing

Included on every plan.

PlansFreeProBusiness

What Certificate monitoring catches
What breaks	hostnag
A certificate expiresdays-before thresholds, daily inside the last window	Yes
A certificate is swappedfingerprint changed, wrong host, chain not trusted	Yes

On the board

Each certificate on its runway: the window spent, the days left, a tick per threshold.

mail.example.com11 d left
shop.acme.example60 d left
Internal CA: build server211 d left

How it works

01
Point it at a host
A hostname or IP and, optionally, a port. hostnag connects with direct TLS by default, or upgrades a plain connection first with STARTTLS for SMTP, IMAP, POP3 or PostgreSQL.
02
Set the thresholds
Days-before-expiry thresholds default to 30, 14, 7, 3 and 1; the last window repeats daily so a certificate close to expiring never falls out of view.
03
A changed or broken certificate is its own alert
Each of these raises its own event, apart from the expiry warnings: a changed fingerprint, a hostname the certificate does not cover, a chain that no longer validates.
04
A renewal that should have happened
A certificate that renews itself (a lifetime of 100 days or less, or an ACME issuer such as Let's Encrypt) is replaced long before it expires. When one is still being served with less than 30 % of its lifetime left, the replacement should already be in place, and hostnag says the renewal looks stuck and to check the job that runs it.
05
Or report one hostnag cannot fetch
Paste or POST a certificate (PEM or DER, capped at 64 KB) to a minted URL for private PKI, client, code-signing or S/MIME certificates. It is parsed once and judged daily.

What you'll be told

What you get told

[Warning] Certificate renewal for shop.acme.example looks stuck
shop.acme.example's certificate should have renewed by now (17 days left of 90 days). Check the renewal job.
Cert
[Critical] api.example.com certificate expires in 2 days
The certificate for api.example.com expires in 2 days (14 Sept 2026). Renew it before then.
Cert
[Warning] Certificate issuer changed on api.example.com
The certificate on api.example.com is now issued by ZeroSSL RSA Domain Secure Site CA (was Let's Encrypt (R11)). If you did not move to a new CA at renewal, find out who issued it.
Cert
[Critical] Certificate on api.example.com is not valid for this host
api.example.com serves a certificate that does not cover this hostname. Browsers will warn visitors.
Cert

Sample alerts, rendered by the same code that writes your email and Slack messages.

Settings

History: a strip of days under the expiry runway, each Healthy, Needs attention or At risk by that day's renewal findings, on the monitor's History, the board's strip views and a status page
Target: a hostname or IP, direct TLS or STARTTLS for SMTP, IMAP, POP3, PostgreSQL
SNI: an optional override for virtual hosting
Timeout: 30s
Interval: 1440 min on Free, 60 on Pro, 15 on Business
Thresholds: 30, 14, 7, 3 and 1 days by default, set per group
Renewal: a self-renewing certificate with less than 30 % of its lifetime left
Reported certificates: PEM or DER, capped at 64 KB, judged daily, every plan

Questions

Do you need my private key?

No. Only the certificate itself, which is public by design, whether hostnag fetches it or you report it.

What counts as a certificate being swapped?

A changed fingerprint, a hostname the certificate does not cover, or a chain that no longer validates. Each is its own alert.

Can I watch a certificate hostnag can't reach from the internet?

Yes. Paste or POST it to a minted report URL; it is judged daily without ever being resolved over the network.

How do you know a renewal failed?

hostnag does not see your renewal job. It sees the certificate being served. When one that renews itself still has less than 30 % of its lifetime left, its replacement should already be in place, so something between the renewal and the server has stopped. The alert says so and names the job as the place to look.

Domain monitoringEvery domain's registration watched for lapsing, a registry hold or a blocked renewal, plus whether its nameservers answer for it and agree, and whether its DNSSEC signatures are still fresh.Discovery and subdomain watchEvery name under a domain, found in its own DNS, its homepage and the names people usually use, each judged live, gone or pointing nowhere, with the ones anyone could claim listed first. A subdomain watch looks again every day and alerts on what changed.Heartbeat monitoringA minted URL for each job that runs on its own schedule, and an alert when a run does not call it in time.

Read

How to monitor SSL certificate expiry (and why 30 days is the wrong first alert)An expired certificate breaks browsers, APIs and mail at midnight. Why one 30-day reminder fails a 90-day certificate, and what to check beyond the date.Certificate transparency explained: the public logs and the certificate you did not orderEvery public certificate for your domain is in the transparency logs. How to tell yours from one you did not order, and what to do about it.How to monitor private PKI, client, code-signing and S/MIME certificates that no scanner can reachInternal CA, client, code-signing and S/MIME certificates are served on no port. Post or paste them to a report URL for the same expiry ladder.

Add a host. Hear about it first.

Start free