Home / Security Tools / Certificate Monitor
Security Tools
Days remaining and issuer for every SAN.
The Certificate Monitor reports the days remaining until each TLS certificate for a domain expires, listing every Subject Alternative Name (SAN) covered by the certificate and the issuing CA.
Enter a domain name (example.org) and run the tool. The probe retrieves the certificate and lists every name it covers with its expiry.
Input: Domain — e.g. example.org.
The output shows the issuer, the not-before and not-after dates, and a table of every SAN with the days remaining until expiry. Certificates within 14 days of expiry should be renewed immediately; an expired certificate triggers browser security warnings and breaks automated clients.
→ Track days-to-expiry for all SANs on a multi-domain certificate.
→ Get an early warning before a certificate expires.
→ Verify renewal succeeded by checking the new not-after date.
→ Audit certificate coverage across many hostnames.
A Subject Alternative Name is a hostname the certificate is valid for. Modern certificates are multi-SAN (UCC) so one certificate can cover example.org, www.example.org and api.example.com — cheaper and simpler than one cert per host.
Renew at least 30 days before expiry to leave buffer for automation failures and propagation. Many ACME clients auto-renew at 20–30 days remaining. Treat anything under 14 days as urgent.
If the CDN terminates TLS, the certificate shown is the CDN’s edge certificate, not your origin’s. Check your origin certificate separately by connecting directly to the origin hostname, and ensure the CDN is configured to serve a cert covering all your SANs.