Detect certificates renewed but not deployed

Add the host you want checked

Owners and admins add a hostname and port under a domain the organization already watches. The hostname has to belong to that domain. Implicit TLS is allowed on 443, 465, 993, 995, and 636. STARTTLS is allowed on 25, 587, and 2525 for SMTP, 143 for IMAP, 110 for POP3, and 389 for LDAP. You can set a separate SNI name. It defaults to the host.

A small container completes the handshake and stores the leaf and chain. DNS is resolved inside that container. If any address is private, loopback, link-local, or shared address space, the connection is refused. The public demo has no endpoints and is never probed.

How the comparison is decided

The endpoint page compares the served certificate with stored rows that have the same set of names. A newer row counts as not deployed only after a grace period, about 48 hours after its not-before, and only when this host is still serving an older certificate for that same set of names. A certificate that shares one name but not the whole set does not count. Matching fingerprint, serial, or public key means the served certificate is that stored row. If the served certificate is not in the inventory, the page says that too.

Free includes 3 manual live checks and does not schedule them. Pro checks each endpoint once a day. Team checks once a day. CertLantern does not install the newer certificate. It only reports the difference. Pro and Team can be alerted when that difference appears.

When no newer certificate shows up

A renewal that was logged and not installed is one failure. The other is a renewal that never appeared. CertLantern alerts when a certificate has passed about two-thirds of its own validity and the logs still have no newer certificate with the same names. That point is day 60 of a 90-day certificate, about day 43 of a 64-day certificate, and about day 31 of a 47-day certificate. Pre-certificates that were never finalized do not count as the newer certificate. The alert is on for Pro and Team, it is sent once per certificate, and it uses the same daily alert caps as every other event.

This is the signal for people who used to wait for an expiry email from their certificate authority. Those messages are easy to lose, and some authorities no longer send them. A shorter lifetime makes one fixed reminder the wrong shape.

What this will not catch

If the renewal was never logged, or it expired before CertLantern stored any row for the domain, there is nothing later to compare against. A host that is not in the endpoint list is not checked. The log inventory and the expiry view still only describe issued certificates. The certificate checker is the same logs-only view for a domain you type in.