Find your certificates.
Track their expiry.

Public websites, internal services, Kubernetes clusters. See which certificates they use and when they expire.

Find internal certificates

A VPN, a certificate file, a Kubernetes Secret. Deploy Sentinel inside your infrastructure to add these observations to your inventory alongside public services.

You enable the discovery modes. Private keys stay with you.

Discovery with Sentinel
Sentinel sourcesExpires in
  • Networkvpn.internal.example.com:443
    7 days
  • File/etc/nginx/tls.crt
    21 days
  • Kubernetesproduction / gateway-tls
    42 days

Check a renewal

A renewed certificate may still need deploying on another server. Inspect the certificate served by each observed endpoint, its fingerprint and its expiry date.

Your existing tools handle issuance and renewal.

Certificate inventory
Certificates served
ServiceFingerprintExpires in
api-01.example.comFingerprint2A:71:BC… 2A:71:BC… 68 days
api-02.example.comFingerprint9F:32:D0… 9F:32:D0… 7 days

Notify the right team

Choose an expiry threshold and recipients for each notification rule. Filter by certificate name or endpoint tag to send the daily digest to the relevant team.

Expiration alerts
Notification rule
Endpoint tag
production
Expiry threshold
14 days
Email recipient
[email protected]

Expiration digest

vpn.example.com
7 days

Preparing a security review?

Business and Custom include detailed certificate and TLS checks, plus timestamped CSV evidence exports. These findings support your review; they do not certify compliance.

Compare plans

Start with your services

Add a public domain, or continue without one to set up Sentinel for internal sources.

Continue

We’ll email you a code to verify your email address.