Start your first digest

Feature

SSL certificate and domain expiry monitoring

Each client site gets two dates on the digest: how long the certificate has left, and how long the domain registration has left. I read them. I do not renew them.

The certificate

On a scheduled check, and when you run a check by hand, I open TLS on port 443 for the site's hostname and read the certificate that is presented. The digest shows days left, the expiry date, and the issuer. If the certificate is already expired, the card says so.

That check follows the digest cadence you set: daily, twice a day, weekly, or monthly, on a Europe/Berlin clock. It is not the live homepage probe. The live probe defaults to every 15 minutes and can be as often as every 30 seconds, and it does not re-read the certificate on each probe.

The public status page shows one certificate line, and only on the homepage component: "Certificate valid until" and the date from the latest digest check. Extra paths do not get a certificate line. Domain days are not on the status page.

The domain

I look up the apex domain at rdap.org and read the expiration event. The digest shows days left and the expiry date, and labels the source as domain renewal. If the host is an IP address, I skip it. If RDAP fails, or the response has no expiration event, the card says Unavailable. I do not treat a failed lookup as an expired domain.

When it is close, and when I email

On the digest, TLS under 21 days and a domain under 30 days become attention, with a next step to renew. That is the page the client can open. It is not an outage email.

I email you, the account, when the certificate is already expired or the domain registration looks expired. Upcoming expiry stays on the digest. That alert does not go to the client. Status-page subscribers are a different list: they can get one mail when the homepage goes down and one when it recovers, after they confirm. They are not mailed about the certificate.

A single site, without an account

The website check reads the same certificate and the same RDAP date for one public URL. Nothing is saved. The monthly version, with the days reprinted on the client page, starts when you add the site. The sample care report shows the TLS and Domain cards in place.

What this is not

Questions

Do you renew the certificate for me?

No. I read the certificate on port 443 and show the days left. Renewal stays with the host or whoever installed it.

Does the status page show domain expiry?

No. Domain days are on the digest. The status page shows the certificate date for the homepage only, as Certificate valid until and the date.

Will the client get an email before it expires?

No. Under 21 days for TLS, or under 30 for the domain, the digest marks attention. I email the account only when the certificate is already expired or the domain looks expired.

Plans are Starter at $9/month for up to 5 sites, Studio at $29/month for up to 25 sites, and Agency at $79/month for up to 100 sites. Studio is the plan marked recommended. Starter, including a trial, keeps a small Powered by RetainerProof link on the client digest and the public status page. Studio and Agency remove that link. Prices are on the pricing page.

More resources

See a sample digest Start your first digest

Also see pricing and a sample client digest.