CertNotify Puts Expiring Certificates on a Watchlist

A website can be healthy in the morning and unreachable by afternoon because a certificate expired, a domain registration lapsed, or a DNS record changed without anyone noticing. None of these failures needs to involve a dramatic attack. Often, the problem is simply that the person responsible was watching the wrong inbox, or watching nothing at all.

CertNotify is built around that gap. It combines one-off checks for websites and domains with ongoing monitoring for people responsible for internet-facing services. The central idea is practical: inspect the things that can quietly break access, then send a reminder before they do.

It starts as a set of one-off checks

You can enter a domain without creating an account and get a report covering its SSL validity, expiry date, TLS version, DNS records and email authentication. That makes CertNotify useful as an initial inspection tool, not only as a dashboard for assets you already manage.

The landing page also presents separate tools for SSL certificates, WHOIS data, DNS records, HTTP headers, uptime, SPF, DKIM and DMARC. There are additional checks for certificate chains, subdomains and possible dangling records. The exact usefulness of each check will depend on the site and the problem being investigated, but the collection gives a developer a way to start with a domain name rather than a pre-existing monitoring setup.

This is where it fits the common use of an SSL checker or domain expiry checker. A scan can tell you what is true now. It does not, by itself, ensure that somebody will notice when the answer changes later.

Monitoring turns findings into reminders

For ongoing monitoring, you create an account and add domains to a dashboard. CertNotify says it checks monitored domains every 24 hours and keeps a history of changes. The service checks the certificate being served, including its issuer, expiry date and chain information, rather than relying only on an internal renewal job reporting success.

Expiry alerts are scheduled for 30, 14 and 7 days before a certificate expires. The service also says it can alert when DNS changes or a site goes down. Email is available, while WhatsApp alerts are part of the paid upgrade. The free plan supports monitoring for up to three domains, according to the product page, while the paid tier removes that limit and adds features such as daily automated checks and certificate chain history.

That distinction between a scan and monitoring is the product's most important practical point. A scan is useful when transferring a site, reviewing a new service or investigating a warning. Monitoring is for the less glamorous work of remembering every domain months after it was registered.

The scope goes beyond certificates

Certificate expiry is the clearest use case, but it is not the only one. CertNotify says it checks domain registration data through WHOIS, examines DNS and DNSSEC configuration, and validates email authentication records such as SPF, DKIM and DMARC. These checks address failures that can affect mail delivery, domain control or availability without producing an obvious application error.

It also reports on older TLS versions, weak cipher suites and certificate configuration. The broader dashboard includes code and supply chain checks for hardcoded secrets, vulnerable dependencies and insecure Terraform, Kubernetes and Docker configuration. That makes the service more than a narrow certificate security monitor, at least in its stated scope.

There is a trade-off in putting these different checks together. A certificate expiry warning has a clear owner and a clear remedy. A DNSSEC issue, an SPF lookup-limit problem or a vulnerable dependency may require a different person and a longer investigation. CertNotify can point to several classes of risk, but it cannot remove the organisational work of deciding who fixes each one.

What it does not replace

The biggest limitation is the monitoring interval. The dashboard checks domains every 24 hours, so it is not a continuous packet-level or transaction-level view of availability. A DNS or certificate problem can exist for some time before the next scheduled check sees it. The product claims immediate alerts for some events, but the stated daily schedule still matters when assessing how quickly it can detect changes.

It is also a web service, not an agent installed inside your infrastructure. That is a sensible fit for public certificates, DNS and HTTP-facing services, but it does not provide the same visibility as an internal monitoring system for private networks, application behaviour or server resource health. The free tools can be used without an account, but ongoing monitoring requires signing up and adding domains manually.

CertNotify is therefore aimed at freelancers, agencies, small teams and businesses that manage several websites or domains and want a shared place for expiry and configuration warnings. It is a reasonable fit when the main risk is forgetting a renewal or missing a public DNS change. It is not a replacement for detailed uptime monitoring, internal observability or a complete incident response system. If you need second-by-second detection or deep application telemetry, its daily domain checks are too narrow. For the narrower problem of keeping public certificates, domains and DNS from quietly becoming someone else's emergency, that focus is the point.