TLS Monitoring
An expired certificate is an outage. A legacy TLS version is a finding on your next pentest. DNS Watchdog checks the TLS posture of every hostname it discovers, every day.
Certificate outages are rarely caused by the certificates everyone is watching. They are caused by the ones nobody knew about: the microservice on a subdomain, the legacy portal a departed team set up, the staging host that quietly became production. Certificate spreadsheets and calendar reminders only cover what someone remembered to write down.
DNS Watchdog scans from your DNS inventory rather than a hand-maintained list, so new hostnames are covered the day they appear - including the ones nobody remembered to add to the certificate spreadsheet. Every hostname serving TLS gets a daily check: expiry dates, hostname match validated wildcard-aware against the certificate's names, self-signed certificates, and key strength - RSA under 2048 bits or ECDSA under 256 bits is flagged as weak. Separate handshakes pinned to each protocol version establish exactly what the server will negotiate, so anything still accepting TLS 1.0 or 1.1 is caught.
Findings are graded so the response effort matches the risk: a certificate expiring within 30 days is an early, calm warning; an expired certificate or hostname mismatch is a High-severity issue; weak keys, self-signed certificates, legacy TLS, and missing HTTPS redirects each land at the right level in between. Alongside the issues, a full certificate inventory - deduplicated by fingerprint, so one wildcard certificate appears once with every record serving it - shows everything discovered across your estate.
How it works
- DiscoverHostnames come straight from your synced DNS inventory - no manual list, no gaps when someone ships a new subdomain.
- ConnectEvery hostname serving TLS gets a daily connection that retrieves the full certificate, exactly as a browser would receive it.
- ValidateExpiry, wildcard-aware hostname matching, self-signed detection, and key strength are checked on every certificate - RSA under 2048 bits and ECDSA under 256 bits are flagged.
- Probe protocolsSeparate handshakes test each TLS version individually, so a server quietly still accepting TLS 1.0 or 1.1 is found even when modern clients negotiate higher.
- Grade and renewFindings are raised at the severity they deserve - from a Low early warning 30 days before expiry to High for expired or mismatched certificates - and auto-close when the fix is observed.
What you get
- Expiry warnings 30 days out, with enough lead time to renew calmly
- Expired certificates and hostname mismatches raised as High severity
- Weak keys flagged: RSA under 2048 bits, ECDSA under 256 bits
- Legacy TLS 1.0 and 1.1 detected with per-version handshake probes
- Self-signed certificates and missing HTTPS redirects surfaced
- A certificate inventory deduplicated by fingerprint across your whole estate
Why it matters
Outages prevented, not postmortemed
An expired certificate takes a service down as surely as a crashed server - and is far more preventable. Thirty days of warning turns an incident into a routine renewal.
Pentest findings pre-empted
Weak keys, legacy protocol versions, and self-signed certificates are the reliable low-hanging fruit of every security assessment. Fix them on your schedule instead of the report's.
Coverage without a spreadsheet
The scan follows your DNS, so every new hostname is monitored from the day it appears. The certificate nobody tracked is exactly the one this catches.
Evidence for audits
A live certificate inventory plus a history of findings and resolutions gives compliance reviews something better than a screenshot of a spreadsheet.
Common questions
Do I need to install anything?
No. DNS Watchdog scans externally, the same way a browser or an attacker would reach your services. If it resolves in your DNS and serves TLS, it is covered.
How much warning do I get before expiry?
A certificate expiring within 30 days raises a Low-severity early warning. If it actually expires, the finding escalates to High - but the point of the system is that it never gets that far.
Which TLS problems are detected?
Expired and expiring certificates, hostname mismatches checked wildcard-aware against the certificate's names, self-signed certificates, weak keys (RSA under 2048 bits, ECDSA under 256 bits), servers still negotiating TLS 1.0 or 1.1, and HTTP endpoints that fail to redirect to HTTPS.