Every TLS certificate you own, and when each one breaks.
Certificate lifetimes drop to 200 days (now), 100 days on March 15, 2027 and 47 days on March 15, 2029. Enter a domain to pull its certificates from public Certificate Transparency logs, find the ones someone still renews by hand, and see what the new caps cost you.
No sign-up. Nothing leaves your browser except the lookup.
Watched daily
Domains in this site's watchlist, scanned every day by GitHub Actions, with live TLS checks.
47-day readiness
0manual renewals a year by 2029
Manual renewals per year
Certificates that look hand-renewed, under each step of CA/B Forum Ballot SC-081v3.
Your first 47-day year
Manual renewals per month from March 2029, each cert renewed about every 40 days.
Next 12 months
When each live certificate expires. Red ones renew by hand.
Who issues your certificates
Live certificates by CA. Solid bars are automated issuers.
Needs attention
Hand-renewed certificates expiring within 30 days, distrusted certificates, and recently expired ones nobody replaced.
Certificate inventory
| Certificate | CA | Renewal | Expires | 2029/yr | Live | Owner |
|---|
Select a certificate to see its renewal history and how to automate it. Owners are saved in this browser only and included in the exports.
How it works
Discover
Every publicly trusted certificate is logged in Certificate Transparency. Cert Radar asks Cert Spotter for the certificates valid today, then crt.sh for the full history when it is available. Renewals of the same set of names are grouped into one lineage.
Classify
A certificate looks manual when it comes from a CA with no sign of ACME use, runs close to the maximum lifetime, renews on an irregular rhythm, or renews at the last minute. Steady renewals well before expiry look automated. Each row shows its reasons.
Forecast
Each manual certificate is projected under the 200, 100 and 47-day caps, renewing about a week before expiry. Unclear ones count as half. The grade weighs the manual share, lapses between expiry and renewal, last-minute habits and anything that needs attention now.
The SC-081v3 schedule
| From | Max certificate lifetime | Domain validation reuse | Renewals a year per cert |
|---|---|---|---|
| Before Mar 15, 2026 | 398 days | 398 days | about 1 |
| Mar 15, 2026 | 200 days | 200 days | about 2 |
| Mar 15, 2027 | 100 days | 100 days | about 4 |
| Mar 15, 2029 | 47 days | 10 days | about 9 |
Passed by the CA/Browser Forum in April 2025 with Apple, Google, Mozilla and Microsoft voting in favour. From 2029, every renewal more than 10 days after the last validation needs a fresh DNS or HTTP check.
Watch your domains for free
Fork the repository, list your domains in watchlist.txt, and GitHub Actions scans them every day, runs live TLS checks and opens an issue when something is about to expire. GitHub emails you about the issue.
Use it in CI
node scripts/scan.js example.com --live --fail-under C prints the report and fails the build when readiness drops below a grade. No dependencies.
What it can't see
Certificate Transparency shows what was issued, not what is deployed, and private or internal certificates never appear in it. A commercial CA's ACME service can't be told apart from a manual order, which is why classification is a guess with reasons.