Cert Watch
Cert Watch opens a TLS connection to each host you list, reads its certificate’s expiry date, and shows a days-left chip per host:
- Green — plenty of time
- Amber — approaching your warn window
- Red — under two weeks, or already expired
A system toast fires when any certificate crosses into the critical window, so a lapse doesn’t wait for you to look at the widget.
What you’ll need
- A list of hosts, or
host:porttargets. A bare host defaults to port443.
Add hosts one at a time in the widget’s ⚙ panel. No token or login is needed — Cert Watch only reads the public certificate that any TLS client sees during a handshake.
Settings
| Setting | Notes |
|---|---|
| Hosts | e.g. example.com, mail.example.com:993, 192.168.1.10:8443 |
| Warn threshold | Days before expiry at which a host turns amber |
| Read self-signed / private-CA certs | Reads expiry dates from certificates your machine doesn’t trust |
Self-signed and internal CAs
Turn on Read self-signed / private-CA certs for homelab hosts behind your own CA. Cert Watch still reads the real expiry date — it just doesn’t refuse the certificate for not chaining to a public root.
The widget also flags a name mismatch when a certificate doesn’t cover the host you dialled, which catches a reverse proxy serving the wrong certificate long before a browser complains at someone else.
Full step-by-step guide lands with the public beta.