Glarion

Certificate monitoring

The client finds out when the site stops loading

A certificate expires on a date somebody could have known about six weeks earlier. It is the only security finding with a deadline printed on it, and it is the one that turns into a phone call from the client rather than a line in a report.

Read from the handshakeNot from a third-party API's opinion of it.
Three thresholdsFlagged at 30 days, escalating at 14 and 7.
One messageYou hear about a change, not the same date weekly.

Why this one is different

Almost everything else a security check reports is a judgement somebody could argue with. Whether a header is set tightly enough. Whether a policy file should be published. Whether an informational finding is worth a client's attention this quarter.

A renewal date is not an opinion. It is a date, it is printed in the certificate the site serves to every visitor, and on the day it passes the site stops loading in every browser with a full-screen warning that most visitors read as "this site has been hacked". There is no interpretation layer and no severity debate. Either somebody renewed it or somebody did not.

Automatic renewal does not remove the risk; it moves it. A renewal hook that has silently failed looks exactly like one that is working, right up until the day it does not.

How Glarion reads it

Over a real TLS handshake to the site, which is the same thing a browser does. The certificate the server actually presents is the certificate that gets checked — not a record in a transparency log, not a cached answer from an API, and not an inference from what the domain's registrar says.

That distinction matters more than it sounds. A site behind a proxy, a site with several certificates for different names, or a site whose renewal succeeded on the origin but never reached the edge will all disagree with a lookup and agree with a handshake. The handshake is the version the visitor gets.

It is also read on the free public check, with no account, because reading a certificate is reading something the site hands to anybody who connects.

The thresholds, and why there are three

30 days remaining
Flagged. Far enough out that renewing is an ordinary task you can put in next week's list, and close enough that it is no longer theoretical.
14 days remaining
Escalated. At this point the reason it has not renewed is usually not "nobody got to it" but "something is broken", and that takes longer to fix than the renewal itself.
7 days remaining
Escalated again. A week is about the shortest notice on which a DNS change, a registrar problem or a hosting ticket can reliably be resolved.

The free check and the paid report use the same first threshold deliberately, so a result you ran without an account and a report you sent to a client never disagree about the same certificate.

Monitoring, not a one-off look

Checking a certificate once tells you about one date. Monitoring is the part that matters: a site on a weekly or monthly schedule gets re-checked, and the expiry is re-read each time, so a renewal that quietly stopped working is caught while it is still an ordinary task.

Notification is sent when a result differs from the one before it. This is the difference between a system you keep and one you mute. A weekly message repeating a date you already know teaches you to filter the sender, and then the week the date changes — or the week it stops moving when it should have — the message goes unread with all the others.

Scheduled checks are part of the paid plans and require current proof that you control the domain, re-checked at the moment the scan runs rather than only when the schedule was set.

Check a certificate now Put a site on a schedule →

Read next