Certificate Transparency monitor for all your domains

WebPixie surfaces certificate validity, chain consistency, expiration, TLS configuration, and certificate identity details for each monitored site. SSL monitoring validates the served certificate against the trusted root CAs, confirms the hostname matches, and requires TLS 1.2 or higher; it then extracts the full certificate chain from leaf to intermediate to root and verifies cryptographic signatures for RSA, EC/ECDSA, Ed25519, and Ed448 certificates. It also reports TLS version, cipher suite, key exchange, key strength, Subject Alternative Names, OCSP and CRL endpoints, and Extended Key Usage OIDs. Expiration tracking is included, with default warnings 15 days before a certificate expires so teams have time to renew. SSL check failures and expiration events can create incidents through incident management, depending on your plan. Teams managing several domains can use the Certificates Manager to review Certificate Transparency inventory across domains and subdomains.

Yes, WebPixie tracks SSL certificate status, expiration, chain validity, and TLS configuration for monitored sites. SSL monitoring runs daily checks that validate the full certificate chain from leaf to intermediate to root, verify cryptographic signatures, and inspect TLS version, cipher suite, key exchange, and key strength. WebPixie also surfaces Subject Alternative Names, OCSP and CRL endpoints, and Extended Key Usage OIDs; Certificate Transparency entries are available in the Certificates Manager. Expiration alerts are sent by default 15 days before a certificate expires, giving your team time to renew before visitors see browser warnings. SSL check failures and expiration events can create tracked incidents through incident management, depending on your plan. If you manage several domains or subdomains, use the Certificates Manager to review the CT-log inventory in one place.

WebPixie uses Certificate Transparency through the Certificates Manager, which turns on automatically for every site with SSL monitoring active. It periodically pulls CT-log entries for each domain you add and lists the certificates seen for that domain and its subdomains. For each certificate it shows the common name, the identity or SAN, the validity window (not before / not after), the issuer, and the serial number, giving you a running inventory of what is in the public record. The same CT data powers subdomain discovery, listing subdomains found in the logs with an action to start monitoring each one. This view is for review, not alerting: WebPixie's notifications come from SSL check failures and expiration, not from CT entries. It differs from SSL monitoring, which validates the certificate your own site actually serves rather than what exists in the logs. Compare plan limits on the pricing page.

Yes, WebPixie checks SSL certificates daily and sends expiration warnings by default 15 days before renewal is due. SSL monitoring validates the served certificate against the trusted root CAs, confirms it matches your hostname, and requires TLS 1.2 or higher, then reads the full chain, checks the expiration date, and surfaces details such as issuer, subject names, TLS version, cipher suite, and OCSP and CRL endpoints. Early warning matters because an expired certificate can trigger browser security warnings, block customer trust, and make checkout, login, or form submission feel unsafe. If a certificate check fails or expiration reaches an alert threshold, WebPixie can notify your team and, on supported plans, create an incident through incident management. Teams with several domains or subdomains can use the Certificates Manager to review CT-log inventory in one place.

Yes. Because the Certificates Manager reads Certificate Transparency logs, it surfaces certificates seen for your domain and subdomains even when they were not requested through your own process. An unexpected certificate can signal a misconfiguration or an unauthorized issuance, and seeing it in the log is the first step to acting on it, so you can tell a legitimate renewal from something that warrants review. The same data set powers subdomain discovery: subdomains found in Certificate Transparency logs and in your main certificate's SANs are listed with an action to start monitoring each one. WebPixie reports what the public record shows; it does not issue, renew, or revoke certificates, which stays with your certificate authority. This complements the per-site checks in SSL monitoring, and you can compare plan limits on the pricing page.