Question 1

My certificates auto-renew — why do I still need this?

Accepted Answer

Because auto-renewal fails silently, and the failure modes are mundane: an expired card on the ACME or CA account, a DNS or firewall change that quietly breaks the renewal challenge, a forgotten subdomain served from a different stack that nobody re-pointed, a renewal cron that stopped running after…

Question 2

When do SSL expiry alerts fire, and can I change the timing?

Accepted Answer

By default, CertSentry warns you at 30, 14, 7, 3 and 1 days before a certificate expires. Each threshold fires once, so you get a timely sequence of nudges without being buried in repeats. Tune it per monitor The lead days are fully configurable on each monitor: Watching something business-critical?…

Question 3

What is Certificate Transparency monitoring?

Accepted Answer

Every certificate issued by a public CA is published to public Certificate Transparency (CT) logs. CertSentry watches those logs for your registrable domain and tells you whenever a new certificate is issued for it — including for any subdomain. Why you'd want this A certificate you didn't expect ca…

SSL & certificates

SSL & certificates