certrota
Start free
ScannerPricingSecurity

Fleet Cert Scanner · free

Which of your clients' certs will bite you first?

Paste your clients' domains. We read public Certificate Transparency logs and list every cert we find, when it expires, and which ones probably live on a firewall, VPN portal or RDS box. Free. No signup to see the results.

0 domains · max 25

One domain per line, up to 25. Just the main domain. We find the subdomains (vpn., remote., mail., portal.) ourselves. We read public CT logs, and open one normal HTTPS connection to each host we find (max 50) to see the cert it serves. No port scans, no logins.

Hostnames–with a valid cert
Look manual–device names or paid CA
Expire before 15 Mar 2027–next renewal is the last long one
Expire in under 30 days–renew these now

Data from public CT logs (crt.sh, with Cert Spotter as backup) and one TLS handshake per host on port 443. Read-only. What we store.