Never be surprised by a certificate.
The renewal job broke weeks ago and failed quietly. The expiry is the first visible symptom, and it arrives as an outage. Or the rotation ran, and the new certificate went out with the wrong chain, a weak key, or a protocol list nobody reviewed.
Nobody reads the certificate that was actually installed.
Automated renewal fails in ways that do not page anyone: a DNS challenge that stops resolving, a token that expired, a deploy step that copies the old file. The certificate on the server is the only thing that knows, and nothing reads it.
A rotation that completes can still be wrong. An incomplete chain works in one browser and fails in another. A key that is too short, or an edge that still accepts an old protocol version, goes unnoticed by a health check that connects from inside.
The inventory drifts. Certificates are added by different teams on different hosts, and the spreadsheet of expiry dates is accurate on the day it was written.
Every certificate read from outside, on a schedule, with a grade.
Dependably StatusCheck inventories the public-facing hosts you operate and opens its own TLS connection to each one, the way your users reach them. It reads the certificate that was actually served and tells your team what changed.
Add the host
Add a hostname from the dashboard or the API. The first certificate check runs immediately.
POST /api/hostsRead the certificate hourly
Every hour by default, a check connects to the host and reads the certificate and its chain: expiry date, issuer, key type and size, and signature. It also records which protocol versions the server accepts and whether the negotiated cipher suite has forward secrecy.
expiry · chain · keyGrade the configuration
Each endpoint is graded A+ to F on its TLS configuration. A rotation that installs a chain that does not validate, or a weak key, changes the grade the hour it happens.
gradeAlert on change
An alert fires when the days remaining cross a threshold you set, and when the grade changes. A failed send is retried rather than lost. Alerts go to Slack, PagerDuty, or a webhook.
threshold · changeAn inventory that speaks before the outage does.
Every certificate you operate, with its days remaining and its grade, on one list.
- Days remaining on every certificate, with a warning threshold you set.
- A rotation is verified by the same check that catches expiry.
- A certificate that changes but keeps its grade raises no alert. A grade change does.
- Domain registration expiry is tracked over RDAP alongside, so the domain does not lapse underneath the certificate.
- host api.example.com
- expires 12 days · threshold 14
- grade A → F
- chain did not validate
Self-hosted and open source.
Dependably StatusCheck is self-hosted and open source under Apache-2.0, and checks from wherever you run it. Our own public status page runs on it, so you can see it working before you install anything, and you can get in touch about your deployment.