The renewal job broke weeks ago and failed quietly. The expiry is the first visible symptom, and it arrives as an outage. Or the rotation ran, and the new certificate went out with the wrong chain, a weak key, or a protocol list nobody reviewed.
Automated renewal fails in ways that do not page anyone: a DNS challenge that stops resolving, a token that expired, a deploy step that copies the old file. The certificate on the server is the only thing that knows, and nothing reads it.
A rotation that completes can still be wrong. An incomplete chain works in one browser and fails in another. A key that is too short, or a server that still accepts an old protocol version, passes every internal check, because internal checks connect from inside.
The inventory drifts. Certificates are added by different teams on different hosts, and the spreadsheet of expiry dates is accurate on the day it was written.
Dependably StatusCheck inventories the public-facing hosts you operate and opens its own TLS connection to each one, the way your users reach them. It reads the certificate that was actually served and tells your team what changed.
Add a hostname from the dashboard or the API. The first certificate check runs immediately.
POST /api/hostsEvery hour by default, a check connects to the host and reads the certificate and its chain: expiry date, issuer, key type and size, signature, accepted protocol versions, and forward secrecy.
expiry · chain · keyEach endpoint is graded A+ to F on its TLS configuration. A rotation that installs a chain that does not validate, or a weak key, changes the grade the hour it happens.
gradeAn alert fires when the days remaining cross a threshold you set, with a further alert at each threshold as the date approaches, and when the grade changes. A failed send is retried rather than lost. Alerts go to Slack, PagerDuty, Microsoft Teams, Discord, Telegram, or a webhook.
threshold · changeEvery certificate you operate, with its days remaining and its grade, read from the server that serves it rather than from a spreadsheet.
Dependably StatusCheck is self-hosted and open source under Apache-2.0, and checks from wherever you run it. Our own public status page runs on it, so you can see it working before you install anything, and you can get in touch about your deployment.