The certificate was renewed, but the edge still serves the old one.
Track the served certificate at the edge so CDN, load-balancer, and platform moves do not hide stale certificates.
Customer-facing SSL/TLS risk
Stop finding expired certificates from customers.
Domain Trust Watch checks the domains and subdomains your team depends on. See when api.example.com has 14 days left, whether Slack received the warning, and whether the renewed certificate is actually served.
Riskapi.example.com: 14 days left
RouteSlack #platform-alerts: Delivered
Next actionRenew before the final week
Workspace preview
Certificate health
api.domaintrustwatch.com
Validcheckout.example.com
Warningidp.example.com
Issuer changedNo private keysEmail verificationSigned webhooks
Workspace evidence
Certificate health, routing, and ownership in one workspace.
The overview shows monitored hostnames, renewal pressure, certificate changes, and whether critical warnings reached Slack, email, or webhook routes.
Where certificate work breaks
A stale edge certificate is enough to break the customer path.
Renewals, CDN changes, and alert ownership rarely live in one clean system. Domain Trust Watch keeps the served certificate, deadline, warning route, and delivery evidence attached to the monitored hostname.
The renewal date belongs to one team and the alert belongs to another.
Attach labels, routes, and workspace ownership to the hostname instead of leaving context in tickets.
The alert fired, but nobody can prove where it went.
Keep delivery attempts beside the certificate event so cleanup is obvious before the next deadline.
What changes
Turn scattered certificate work into a visible operating record.
The product is not just another reminder. It connects the failure mode to the operational proof a team needs when ownership shifts.
Failure modeA spreadsheet says the certificate was handled.
With Domain Trust WatchThe dashboard confirms what the public endpoint is serving now.
Evidence kept
- Served issuer and expiry
- SAN coverage
- Fingerprint and serial number
What the team sees
Proof that is useful during the incident review, not just before it.
Each alert points back to the monitor, served certificate, and delivery trail, so the next action is easier to trust.
Sample monitor
shop.example.com
Action needed: expires Jun 18, issuer Lets Encrypt, checked 6 minutes ago.
api.example.com has 14 days left. Next action: Renew before the final week.
Delivered to Slack #platform-alerts after 1 attempt.
42 accepted, 3 duplicates, 2 malformed rows.
Hostname evidence
A complete certificate record for one monitored endpoint.
Monitor detail keeps the served certificate, SAN coverage, fingerprint history, check timeline, and alert delivery attempts attached to the hostname.
What teams are saying about Domain Trust Watch
Certificate work gets easier when expiry, served certificate state, ownership, and alert delivery live in one visible record.
“The renewal window finally shows up with the evidence attached.”
Domain Trust Watch gives our team one place to check the certificate actually served at the edge, the renewal window, and whether the warning reached the right channel.
“The useful part is the delivery trail. We can see the monitor, issuer, expiry, and alert delivery state without asking three people to confirm what happened.”
“It catches the drift calendar reminders miss. That matters when domains move between hosting, CDN, and client-owned DNS accounts.”
“The team stopped guessing where alerts went. Having Slack, email, and webhook delivery attempts beside the certificate event makes expiry cleanup much easier to trust.”
“Client handoffs are less fragile now. We can keep client domains, owners, renewal context, and certificate evidence in one operating record instead of scattered tickets.”
How it works
Check, warn, and verify the endpoint customers use.
A small workflow, built around the thing customers actually touch.
Check the live endpoint
Domain Trust Watch reads the certificate actually served by the domain or subdomain users connect to, not the renewal date copied into a calendar.
Route the risk
Warnings go to the route attached to that monitored hostname, with delivery attempts visible next to the event.
Keep the evidence
Snapshots preserve issuer, SANs, fingerprint, chain depth, expiry, and validation state after renewals or edge changes.
Workspace
Enough structure to keep certificate ownership visible.
Add one hostname, run a live check, bulk import the rest, and route warnings to the channels your team already watches.
Start with one hostname
Run the check, then keep the certificate evidence on watch.
Use the free checker to see the certificate served right now. Add monitoring when the hostname needs renewal warnings, change history, and routed alerts.
01Live TLS read02Full result03Monitor if needed