FAQ
Questions about CertLantern
Short answers about public logs, expiry, live checks, and the live demo. Longer notes are on the guide pages linked from the footer.
Does a certificate in CertLantern mean it is installed?
No. Certificate Transparency records issuance, not deployment. A name can show up because someone requested a certificate, even if it was never installed on a server.
Will CertLantern list every certificate ever issued for a domain?
It lists the issuances the public logs return. CertLantern tries multiple independent Certificate Transparency sources. If the first source fails or is rate limited, another source is used, including when certificates are already stored. Certificates that expired before the first successful read may be missing, because the primary source lists unexpired issuances. Once a certificate is stored, it stays after it expires.
How do I see expiry dates?
The inventory shows not-after and the days remaining. Expired certificates and those expiring within 7 days are highlighted one way, those within 30 days another. Filters cover 7, 14, 30, 60, and 90 days. Pro and Team can export CSV and a printable report, including an owner or notes field.
How can I tell that a renewal was logged but not deployed?
Add a host under a domain you already watch. CertLantern completes a TLS handshake and compares the served certificate with stored rows that have the same set of names. A newer row counts as not deployed only after about 48 hours from its not-before, and only when this host is still serving an older certificate for that same set. Free includes 3 manual live checks and does not schedule them. Pro checks each endpoint once a day. Team checks once a day. CertLantern does not install the new certificate for you.
Does CertLantern email me before a certificate expires?
Pro and Team can email selected members at 30, 14, 7, and 1 days before not-after, and again when a certificate is already expired. On those plans, renewal-overdue, unexpected certificate authority, new-name, and CAA alerts are on too. Team can also send Slack, Teams, Discord, and generic webhooks. Free does not send alerts. There is no customer API.
Do names on subdomains count as extra domains?
No. You add the domain, and every name the logs return for it is included, including subdomains and wildcards. The plan counts that domain. An endpoint is a host and port you ask to be probed, and only those count toward the endpoint limit.
Who can see my inventory?
Only members of your organization. The live demo is the only organization inventory available without signing in. Anyone can look up one public domain on the certificate checker without an account. The live demo is an example domain from public Certificate Transparency logs.
Does the live demo connect to its example domain?
No. The live demo is an example domain from public Certificate Transparency logs. It has no endpoints and is never probed.