01Stocktake
Count every certificate
One domain in, the whole shelf out: names, issuers, best-before dates, lifetimes, renewals per year, and a ledger of every certificate with a link to its log entry.
Count a domainCertificate stocktake · free to count
Take stock of every certificate with your name on it.
Type your domain. The shop reads the public Certificate Transparency logs and counts every SSL/TLS certificate in the public logs for it and its subdomains: days left on each name, renewals that look stuck, names you forgot, issuers you did not expect, and whether the newest one is really installed.
Fresh
www.bakery.example
64
days left
best before 2027-01-05
Late renewal
mail.bakery.example
9
days left
best before 2026-11-11
Past best-before
shop2019.bakery.example
Expired
612 days ago
best before 2025-02-28
Every name
on a public certificate in the logs for your domain, wildcard names too
Days left
on the newest certificate for each name, with its best-before date
Late renewals
short-lived certificates close to expiry with no newer one logged
On the counter?
whether your server hands out the newest one, or an older copy
Three aisles
Count it, check it, keep it.
02Counter check
Is the newest one installed?
A renewal that was issued but never loaded is a classic outage. One click per name opens a connection to your server and compares what it hands out with the newest logged certificate.
How the check works03Stock Book
Recounted every day
Keep your domains in a private book (no account, no email). The shop recounts them daily, logs anything new on the shelf, and puts each best-before date in your own calendar.
Open the Stock BookReading the labels
Five labels, one meaning each.
Every name gets the label of its newest certificate. The rules are on Shelf life.
- FreshMore than 30 days left.
- Renew soon30 days or fewer left.
- Late renewalA short-lived certificate (100 days or less) with fewer than 20 days and less than 22% of its life left, and no newer one logged. Automatic renewal may be stuck.
- Past best-beforeThe newest certificate for the name has expired: a forgotten name, or a renewal that lapsed.
- CoveredExpired on its own, but an in-date wildcard certificate covers the name.
Prices
Counting is free. The stock room is $1.95.
On the open shelf
Free
$0
- 6 stocktakes a day, full stock sheet
- Shelf labels, issuers, CAA check and draft, ledger
- 12 counter checks a day
- Stock Book with 1 domain, recounted when you ask
Shop Pass
Keep the whole stock room
$1.95/month
or $19.50 a year (two months free)
- Stock Book of 25 domains
- Automatic daily recount, "new on the shelf" and date alerts
- Best-before calendar (.ics) and Atom feed: no email needed
- Expected-issuer alerts, CSV of every name and certificate
- 40 stocktakes and 60 counter checks a day
Free during preview
Checkout is not open yet. Every Shop Pass feature is on for everyone until it is, and nothing is charged. When it opens, payment is by PayPal, monthly or yearly, cancel any time.
We sell no certificates, issue none, resell none, and show no seals. The Shop Pass buys the stock room, not a certificate.
Questions at the till
Before you count.
Where do the certificates come from?
Every publicly trusted TLS certificate is recorded in Certificate Transparency logs before browsers will trust it. The shop asks crt.sh (run by Sectigo) for every logged certificate for your domain, and Cert Spotter (by SSLMate) for the ones still in date, and merges the two. If crt.sh does not answer, Cert Spotter's list is used alone and the sheet says so. Cert Spotter is asked at most 8 times an hour by the whole shop, so at busy times a sheet can come from crt.sh alone; it says so too, because crt.sh sometimes lists a new certificate late. Private certificates and certificates from before the logs began are not in them, and for a domain with a very large history the sheet keeps to the in-date certificates and says so.
Can anyone count my domain?
Yes, the same way anyone can search crt.sh: the logs are public by design. That is also why it is worth knowing what is in them, for example an old test name or an internal host name on a public certificate.
Do you connect to my server?
Not for the count. Only when you press "Check the counter" on a name: one TLS handshake on port 443 to read the certificate the server hands out, nothing else. Private and reserved addresses are never contacted.
Do you sell certificates or seals?
No. We sell no certificates, issue none, resell none, and show no "secured by" seals. If you need a certificate, your host or a certificate authority issues it; Let's Encrypt and Google Trust Services issue them free.
Will you email me?
No. The Stock Book gives you a calendar file and a feed you add to your own calendar or feed reader. There is no account and no mailing list.