How CertLantern works

What gets recorded

For each domain in an organization, CertLantern stores certificates it finds in Certificate Transparency: names, issuer, serial, not-before, not-after, key information, signature algorithm, source, and a fingerprint when the log includes the certificate. Every name those certificates carry for that domain, including names on subdomains, is part of the inventory. You add domains, not each name. Expired rows stay visible and are highlighted. Certificates that expired before CertLantern ever saw them may be missing, because the primary source lists unexpired issuances. Once a certificate has been stored, it remains after it expires.

Alerts

Email alerts are on Pro and Team. Slack, Teams, Discord, and generic webhooks are on Team. There is no customer API. Expiry alerts use fixed day counts. A renewal-overdue alert uses about two-thirds of that certificate's own lifetime, so it fits a 90-day, 64-day, or 47-day certificate, and it fires when no newer certificate for the same names is in the logs. The live demo is an example domain from public Certificate Transparency logs and never opens a connection to that host.

The first refresh trusts every certificate authority already in the inventory, so you are not mailed about the past. After that, Pro and Team send a renewal-overdue alert, an unexpected certificate authority alert, a new-name alert, and a CAA alert when a CAA record would stop the current issuer from renewing. A new public key stays off, because renewals rotate keys. Open the alert and choose Trust this CA, or change the list on the domain's Issuers page. These alerts use the same daily alert caps. The CAA lookup runs at most once a day, inside a refresh that is already queued.

Signing in

Enter your email and CertLantern sends a link that expires in about 15 minutes and works once. The link is stored only as a hash, and it is bound to the address that requested it. Asking for a link looks the same whether or not that address already has an account. After you are signed in, Account can store a password. That password works only once the email is confirmed. Google sign-in appears when it is configured, and it accepts only an email Google has verified. In production the message is sent from the configured CertLantern sender. Local development prints the link in the worker log instead, and that log mode cannot run in production.

Organizations and roles

The first person to create an organization is its owner. Owners and admins can add domains and invite people. Owners change roles. Viewers can read the inventory. Pro and Team can export a CSV and a printable report. Every row belongs to one organization. An audit log records sign-ins, domain changes, invites, role changes, exports, and alert channel changes for owners and admins.

Refresh

A cron trigger runs every 5 minutes and only enqueues work. Queue consumers refresh one Certificate Transparency page per message, or probe one endpoint. CertLantern reads multiple independent Certificate Transparency sources. If the first source fails or is rate limited, it is skipped for a while and another source is used, including when the domain already has stored certificates. An optional API token for the log service raises its rate limit. Daily caps stop the scheduler when usage would exceed the budget. The dashboard then shows a Paused for budget notice until the next UTC day.

Endpoint probes

Owners and admins can add a host and port under a domain they already watch. That host is an endpoint, and the plan counts endpoints separately from domains. The hostname has to belong to that domain. Allowed ports are 443, 465, 993, 995, and 636 for implicit TLS, and 25, 587, 2525 (SMTP), 143 (IMAP), 110 (POP3), and 389 (LDAP) for STARTTLS. A small container completes the TLS handshake and returns the leaf and chain. Free includes 3 manual live checks and does not schedule them. Pro checks each endpoint once a day. Team checks once a day. The endpoint page compares the served certificate with the Certificate Transparency inventory and calls out a renewal that was logged but is not deployed.

The probe resolves DNS inside the container and refuses the connection when any address is private, loopback, link-local, or shared address space. The public demo has no endpoints and is not probed.

Reading the table

Filters cover search text, domain, and windows of 7, 14, 30, 60, and 90 days. Pro and Team can download a CSV or open a printable report with host, issuer, key type and size, signature algorithm, validity dates, days left, status, and an owner or notes field. Cells that start with a spreadsheet formula character are prefixed. The report is a snapshot of what CertLantern has stored, for notes such as PCI DSS 4.0 requirement 4.2.1.1 and DORA. It is not a completed assessment.

The public demo

The live demo is read-only and needs no account. It is an example domain from public Certificate Transparency logs. The certificate checker looks up one other domain the same way, still without a probe.

Privacy

CertLantern stores your email, the domains you add, the public certificates it finds, session records, and the audit log. Magic-link tokens and session cookies are stored as hashes. A password is stored as a salted PBKDF2 hash. Google sign-in, when it is turned on, stores the verified email and Google's account id, not a Google password. The session cookie is HttpOnly, Secure on HTTPS, and SameSite=Lax. Sign-in attempts are rate limited per IP and per email. The public checker caches a domain and its log page for about a day and does not record who looked it up.

Pricing

Early pricing

Early pricing; billing isn't live yet

Nothing is billed. Listed domain, endpoint, live-check, and member limits are enforced.

CSV and the printable inventory report are on Pro and Team. Renewal-overdue, unexpected certificate authority, new-name, and CAA alerts are on Pro and Team.

Terms · Privacy · Refunds