SSL certificate monitoring that stops counting down days
A healthy 90-day certificate is always close to expiry — that’s what a healthy certificate looks like. Lapsewatch watches whether the renewal actually happened instead, and catches the one week a year your ACME client silently stopped working.
No signup. Real results in about four seconds.
How Lapsewatch judges a certificate
Every day, Lapsewatch opens a raw TLS connection to the domain and reads the live certificate — issuer, serial number, validity window — the same handshake a browser performs.
Renewal-failure detection, not a countdown
Counting days to expiry produces constant false alarms once certificates are measured in weeks. Instead Lapsewatch tracks how much of the certificate’s lifetime remains and whether the serial number changed since the last check — that’s the actual signal that a renewal happened.
ARI — straight from the issuer
Where the certificate authority supports ARI (RFC 9773), Lapsewatch asks it directly which renewal window it recommends for that exact certificate. When the window has passed and the serial hasn’t changed, that isn’t our guess — it’s the issuer’s own answer.
No false alarm on day one
A brand-new domain has no history to compare against, so Lapsewatch never calls a certificate critical from a single observation — “the renewal is failing” is a claim about a trend, and a trend needs at least two points.
Why certificate lifetimes keep shrinking
The CA/Browser Forum has scheduled maximum publicly-trusted certificate lifetimes to fall to 200 days in March 2026, 100 in March 2027, and 47 by March 2029. Let’s Encrypt already issues six-day certificates for some use cases. Every one of those certificates spends its entire life visibly “about to expire” — which is exactly why a days-remaining alert becomes useless as lifetimes shrink: it would fire permanently, and a permanent alarm gets ignored.
The question that actually matters isn’t “how many days are left” — it’s “is the automated renewal still working.” That’s the one thing a shortening lifetime doesn’t change, and it’s the one thing worth monitoring.
SSL certificate monitoring, answered
My certificates auto-renew with Let’s Encrypt. Why would I need this?
Because auto-renewal is a cron job or a systemd timer running unattended on a server nobody watches. It fails silently when a firewall rule changes, a rate limit is hit, or a config drifts — and the first sign is usually a certificate warning in a client’s browser, which is the worst possible way to find out.
What’s the difference between this and a plain SSL checker?
A one-off checker tells you today’s expiry date. Lapsewatch compares today’s certificate against yesterday’s, tracks the serial number, and — where ARI is available — asks the certificate authority which renewal window it actually recommends. That turns a single data point into a trend.
Do you support wildcard and multi-domain certificates?
Yes — Lapsewatch reads whatever certificate the server presents for that hostname, wildcard or not, and tracks its own renewal cycle independently of the domains behind it.