CA/B SC-081v3 · cert lifetimes: 200 days now → 47 by 2029
Find expiring certificates
before your customers do.
Add your hosts. trackssl runs a read-only scan every day and emails you weeks before notAfter becomes an incident.
3 hosts free · no credit card · 2-minute setup
✕ Without trackssl
Your connection is not private
certificate expired · 03:12 AM
You find out at 3am — from a customer screenshot.
✓ With trackssl
You find out weeks early — and fix it on your schedule.
The problem
How many certs are you tracking in your head right now?
- Running openssl s_client by hand. Again.
- Updating the expiry spreadsheet. Again.
- Trusting that the renew cron worked. Again.
- Finding out from a customer it didn't. Again.
Hours of incident calls —
for a renewal that costs nothing.
Real product
Every cert you own, on one screen
Status at a glance in the same green / amber / red language your alerts use. No digging through openssl output at 3am.
Hosts
last scan 06:00 UTC · next in 14h 22m| Host | Expires | Status |
|---|---|---|
| api.acme.com | 54 days | VALID |
| www.acme.com | 41 days | VALID |
| shop.northwind.io | 102 days | VALID |
| legacy.contoso.net | 9 days | EXPIRING |
| old.merlinware.com | expired 3 days ago | EXPIRED |
| staging.acme.dev | first scan queued | OBSERVING |
How it works
Three steps. Then you stop thinking about it.
Add your hosts
Paste hostnames — apex, subdomains, internal-facing endpoints. No agents, no DNS changes, nothing to install.
$ add www.acme.com
✓ 2 hosts queued for first scan
We scan daily
A read-only TLS handshake against every host, every day. Issuer, chain, protocol, and exact expiry — recorded and diffed.
issuer change detected: www.acme.com
E5 → E6 · renewal confirmed
Get alerted in time
Email lands at 30, 14, 7, 3 and 1 days out — long before browsers start showing warnings to your customers.
Who it's for
Built for people who answer when certs break
Agencies & freelancers
Your clients' certs are your reputation. Watch the whole portfolio on one dashboard and send client-ready health reports.
50 client domains audited in ~1 minute
DevOps & SRE teams
Renewal automation fails silently. trackssl is the external, read-only check that doesn't trust your renew job — it verifies it.
issuer & chain changes diffed daily
Solo devs & indie hackers
You don't have an ops team. For your side projects and client work, trackssl is the ops team for your certificates.
set up once · alerts at 30/14/7/3/1d
CA/Browser Forum · ballot SC-081v3
The yearly certificate is dead
Maximum certificate lifetimes are shrinking on a fixed schedule. Renewals stop being an annual chore and become a constant background process — one that fails silently until a customer sees the warning page.
until Mar 2026
398
days. The annual renewal. Already gone.
Mar 2026 — now
200
days. Two renewals a year, per cert, today.
Mar 2027
100
days. Quarterly, for every host you run.
Mar 2029
47
days. Roughly eight renewals a year, per cert.
— days until the 100-day cap. When automation breaks at that cadence, you find out from monitoring — or from your customers.
Pricing
Cheaper than one incident call
Free
$0 /mo
See it catch something. No card needed.
- ✓ 3 hosts
- ✓ Daily read-only scans
- ✓ Email alerts at 30/14/7/3/1 days
- ✓ One free portfolio audit
Solo
$9 /mo
Every host you run, watched every day.
- ✓ 25 hosts
- ✓ Everything in Free
- ✓ Issuer & chain change detection
- ✓ Scan history & diffs
- ✓ Priority support
Agency
$29 /mo
Your whole client portfolio, plus the reports to prove it.
- ✓ 200 hosts
- ✓ Everything in Solo
- ✓ Client-ready shareable reports
- ✓ Weekly portfolio digest
- ✓ Team seats
One expired cert costs an incident call, an apology email, and a day of lost checkout traffic. trackssl costs less than any one of those.
FAQ
Frequently asked questions
How does the scanning work?
trackssl opens a read-only TLS handshake to your host — the same thing a browser does — and records the certificate's issuer, chain, protocol and exact expiry. Nothing is installed and nothing is written to your servers.
Do I need to install an agent or change DNS?
No. If a browser can reach the host, trackssl can scan it. Setup is pasting a hostname.
When do alerts go out?
Email alerts land at 30, 14, 7, 3 and 1 days before expiry. You'll also hear about issuer changes and failed renewals the day the daily scan detects them.
I already have certbot / auto-renewal. Why do I need this?
Automation fails silently — an expired DNS token, a changed load balancer, a forgotten staging box. trackssl is the independent external check that verifies the renewal actually shipped to production.
Can I monitor my clients' domains?
Yes. Agencies add client hostnames like any other host, and the Agency plan generates shareable, client-ready health reports for each portfolio.
What's the 47-day thing about?
CA/Browser Forum ballot SC-081v3 caps certificate lifetimes on a fixed schedule: 200 days today, 100 days from March 2027, and 47 days from March 2029. Renewals become roughly eight-times-a-year per cert — which makes silent failures far more frequent.
One of your certs is expiring
right now.
trackssl finds it. You renew it. Done. Add your first host in two minutes — free, no card, nothing to install.