CertPost: Proactive TLS Certificate Monitoring for a 47-Day Industry Future

Research context and background

The internet security industry is changing how SSL and TLS certificates work. A major group called the CA/Browser Forum has set a goal for 2029 to shorten how long these certificates last. Instead of lasting a year, they will only last 47 days. This change means websites must renew their security certificates nine times every year. This creates a big risk because there are now nine chances for a renewal to fail without anyone noticing. Old ways of checking for renewals are not enough. Companies need to see the actual state of the certificates that visitors see on the web.

Benefits

CertPost helps organizations avoid common mistakes that lead to website downtime. It offers several key advantages:

• Real-Time Validation: The tool checks expiry dates, certificate chains, hostnames, and TLS ports in real time. It does not just check if a renewal script ran. It checks what is actually being served.
• Proactive Warnings: Users get alerts four times before a certificate expires. These warnings happen at 30 days, 14 days, 7 days, and 1 day before the deadline. This gives teams plenty of time to fix issues.
• Comprehensive Chain State: The platform validates every link in the certificate chain. It alerts if an intermediate certificate is expiring. This prevents errors where a site becomes untrusted even if the main certificate is fine.
• No Installation Required: The service connects from the outside like a normal visitor. It does not need any agents or software installed on the server. This makes it easy to set up.
• Universal Compatibility: It works with any technology that handles TLS. This includes Nginx, Caddy, Traefik, Cloudflare, Apache, and Kubernetes.

Use Cases

CertPost is designed for teams that manage web servers and need to ensure their sites stay secure and online. It is useful in the following situations:

• Preventing Silent Failures: If a renewal script runs but the web server fails to update, CertPost detects the mismatch between the file on the disk and what is served to users.
• Handling Intermediate Expiry: When an intermediate CA certificate is about to expire, the tool alerts the team. This stops sites from showing trust errors.
• Checking Wildcard Scope: If a wildcard certificate does not cover a new subdomain, CertPost finds the issue. This ensures all parts of a website are protected.
• Early Customer Discovery: Sometimes customers report a broken site before the internal team knows. CertPost provides earlier warnings so the team can fix the problem before customers complain.
• Supporting Multiple Technologies: Teams using various web servers or cloud setups can use one tool to monitor all their certificates without needing different tools for each platform.

Pricing

CertPost is priced per account. This means adding new hosts does not increase the cost. The plans are as follows:

• Free Plan ($0/month): This plan allows monitoring of 3 certificates forever. It includes daily checks and email and webhook alerts. No credit card is required to start.
• Team Plan ($29/month): This plan offers unlimited certificates and hourly checks. It includes Slack and webhook alerts, change alerts, and support for 5 seats.
• Agency Plan ($79/month): This plan provides 15-minute checks. It also includes public status pages for clients and priority support.

Vibes

CertPost is designed to solve a specific and growing problem in web security. The shift to shorter certificate lifetimes means the margin for error is shrinking. The product positions itself as a robust and agentless solution. By monitoring from the outside, it ensures that an organization sees exactly what the end-user sees. This approach eliminates the blind spots found in traditional renewal-only monitoring strategies. The focus on proactive warnings and chain validation suggests a tool built for reliability and peace of mind.

Additional Information

CertPost addresses the industry roadmap set by the CA/Browser Forum for 2029. The platform was built to handle the increased operational risk that comes with 47-day certificate lifetimes. It targets the most frequent causes of downtime related to certificates, such as server reload failures and intermediate expiry. The service connects externally to simulate a visitor request, ensuring that the monitoring reflects the real-world experience of users accessing the site.