CertWatch

CertWatch is a self-hosted TLS monitor that ships as a single Go binary with SQLite - no database server, no agents, no telemetry.

It watches certificate expiry with staged severities (30/14/7/1 days) and grades the configuration itself: protocol floor, cipher quality, chain completeness, hostname coverage, key strength and signature algorithms. A separate capped probe reveals servers that still accept TLS 1.0/1.1 even when your browser negotiates 1.3.

Every finding carries its fix, is deduplicated across scans so a certificate going from 20 to 19 days is the same finding rather than a new alert, and auto-resolves once you fix the cause. Notifications batch into one worst-first digest instead of a flood.

Honest limits: it is TLS only, not an uptime monitor; it does not renew certificates (pair it with your ACME client); and it can only check what is reachable from where it runs, so internal segments need their own instance.

The free edition is Apache-2.0, monitors 10 hosts and runs the same engine as the paid tiers. CertWatch is one of six self-hosted security tools built on a shared Go core.