Security & Compliance · Certificate and domain expiry monitor

ExpiryWatch

Nothing expires by surprise.

Every certificate and domain you own, including the subdomains you forgot, checked daily, with a Slack or Teams message before anything expires.

Agencies and MSPs with many client domainsCompanies with many brands or country sitesTeams that have had a certificate expire

Book an ExpiryWatch demo See pricing

expiry-watch · example

$ expiry-watch check duvaxa.com www.duvaxa.com github.com
duvaxa.com   domain  364d  (2027-10-23, GoDaddy.com, LLC)
duvaxa.com   cert     89d  (2027-01-21, Google Trust Services)
github.com   cert     37d  (2026-11-29, Sectigo Limited)
WARNING EW008 duvaxa.com: still accepts TLSv1
INFO    EW020 duvaxa.com: no CAA record

Real run against live domains, including our own, which it flagged for still accepting TLS 1.0.

ChecksCertificates, domains, DNS, HTTPS

FindsForgotten subdomains

AlertsSlack, Teams, webhooks

Runs onYour CI or any server

The problem

An expired certificate or a missed domain renewal takes a website, an API or a mobile app offline, and it still happens to large companies every year. Certificates live on many servers, domains with many registrars, and nobody owns the list.

What it does

TLS certificates: days left, trusted chain, hostname coverage, self-signed, and old TLS 1.0/1.1 still accepted

Domain registrations through RDAP, the registries' official lookup: expiry, client hold and transfer lock

Email and DNS safety in the same pass: CAA, SPF, DMARC and DNSSEC

HTTPS hygiene: plain http not redirected, missing HSTS

Finds forgotten hostnames from public Certificate Transparency logs and checks them too

Daily alerts to Slack, Teams or any webhook, only when something needs action

No agent and no account: runs in your own CI or on any server

How it works

List your hosts, or discover them from Certificate Transparency
Run it daily from CI or cron with a Slack or Teams webhook
Fix what it flags before it becomes an outage

Works with

Let's EncryptCloudflareGoDaddyRDAPCertificate TransparencySlackMicrosoft TeamsGitHub Actions

Runs in your CI

GitHub Actions workflow step

# Daily, with Slack alerts
expiry-watch check --file hosts.txt --min-severity warning --webhook $SLACK_WEBHOOK

Licensed customers get the action or command-line tool installed in their own organisation; it runs on your runners, so your code and plans never leave them. The command-line tools run in GitLab CI the same way.

Your data

Checks only public information: certificates, registry and DNS records.
Nothing to install on your servers.
Your host list stays in your repository.

Who it's for

Agencies and MSPs with many client domainsCompanies with many brands or country sitesTeams that have had a certificate expire

Questions

Doesn't our host renew certificates automatically?

Usually, until it doesn't: a changed DNS record, an expired card or a server outside the automation. ExpiryWatch is the independent check that catches those.

Can it check internal hosts?

Yes, when it runs inside your network; it checks from wherever it runs.

Often used with ExpiryWatch

Security & Compliance

MaskWall

AI data firewall

Use AI. Keep your secrets. A protective layer between your company and every AI service. Keys, passwords and customer data are blocked or masked before they leave, and quietly restored in the reply.

$199–499/month (₹8,000–25,000 in India)View product → Security & Compliance

PrivacyPilot

DPDP privacy compliance

Privacy compliance, made practical. Find the gaps between your website and India's DPDP Act, and get the privacy notice, data inventory and consent banner to close them. Notices are checked against GDPR, UK, US and Australian rules too.

₹2,999 per siteView product → Security & Compliance

CERT-In Ready

CERT-In compliance check

CERT-In, checked properly. Check your infrastructure against the CERT-In Directions as written: 180 days of logs held in India, synchronised time and incident reporting.

₹25,000–75,000View product →

← PreviousLogTrim Next →StackAudit

See ExpiryWatch on your own data

A 30-minute call. We run the product on your export, repository or document and walk you through the results.

Book a demo