Most expiry checkers look at one hostname. Nameward checks your main domain,
www, and the subdomains that recently had certificates issued (found in
Certificate Transparency logs), connects to each, and reports what it
actually serves.
What it tells you per host
- Issuer and expiry date of the certificate the server presents.
- Status, relative to the certificate's lifetime: Act now when little of its life is left (or it's expired, or not trusted for that name), Watch when most of it is used and no renewal has been seen.
- Renewed but not installed: a newer certificate for the same names is in the CT logs, but this server still serves the old one. The most common cause of "we renewed it and it still expired".
- Hosts that don't answer HTTPS from the internet are listed as such, not as errors.
When a host needs action
- Find where the certificate is installed: web server, load balancer, CDN or appliance.
- Install the renewed certificate there, with its intermediate, and reload the service.
- Check again from outside.
Step-by-step: Certificate renewed but not installed, and runbooks for FortiGate, SonicWall, Sophos Firewall, IIS and Remote Desktop and Exchange hybrid.
Keep watching
Certificate lifetimes are shrinking to 47 days by 2029
(why). Monitoring checks every few hours,
including hosts on other ports such as vpn.example.com:4433, and alerts you
before an expiry, not after.