Warden
Warden monitors SSL/TLS certificates, endpoints, and domains to detect renewals, misconfigurations, and outages- then alert you before production breaks.
Monitor all your endpoints and domains in one view
Detailed certificate information and validation
Built for teams running nodes, servers, and platforms in production
Smart email notifications keep your team informed
Reads the expiration date from the certificate your endpoint is actually serving, then sends reminders at 30, 7, 3, and 1 days remaining.
Compares certificate fingerprints over time to catch renewals, unexpected replacements, and “wrong cert on the edge” deployments.
Validates the requested hostname against the certificate’s SAN/CN the way strict clients do — including SNI routing and wildcard edge cases.
Flags missing intermediates and obvious chain breaks so you don’t ship a cert that “works in some browsers” but fails in API clients.
Runs a real TLS handshake (with timeouts) and reports handshake failures separately from certificate problems.
Separates DNS failures from TCP issues (timeouts/refused) so you can tell whether it’s a record change, firewall, or origin outage.
Auto-renew usually means a new certificate was issued — not that it’s installed and serving in production. Common failures include: DNS/HTTP validation timeouts after a DNS or provider change, load balancers and CDNs still serving the old cert, deployment steps failing, or permission/path issues that prevent renewed files from being read. Warden checks the certificate your users actually receive.
Browsers show a warning and humans sometimes click through (or they test on a different hostname), but API clients and mobile apps fail hard on hostname and chain validation errors. Example: you deploy *.app.example.com, but your API is api.example.com (not covered by that wildcard). Warden validates hostname matching the way strict clients do.
If a certificate is expired, new HTTPS requests should fail — but you can still see something if the browser is showing a cached page, a service worker offline copy, or previously loaded assets. Meanwhile APIs and fresh loads break. Warden tests the live TLS handshake to the endpoint, not cached content.
Tell Warden which domains and ports to monitor
Warden checks certificates every 15 minutes automatically
Get notified when certificates expire, change, or fail validation
Resolve issues before they impact production