For web agencies
Know before your client does.
Dewline checks every client site you manage for silent SSL failures, broken root/www setups, and domains about to expire, before they turn into an angry phone call.
Free check for up to 50 domains. No signup needed.
Results
| Issuer | Certificate type | Host / CDN | Registrar |
|---|
Root and www are both checked for every domain. Certificate type and host/CDN are best guesses. 🔵 Renews soon means the domain renews in 15–60 days (informational). Click a row for full details.
Get early access to automatic monitoring
Dewline will check your client sites every day and warn you before a certificate or domain lapses. Join the early-access list and help shape it.
Why this matters
Auto-renewal fails silently.
Certificates are supposed to renew themselves, until a server update or a DNS change quietly breaks it.
Domains lapse without warning.
When a client's domain expires, their website and email go down together, and the agency gets the call.
Nobody's watching both halves.
A site can work at example.com and be broken at www.example.com for months.
We checked the client portfolios of 20 web agencies. More than half had at least one client site with a real problem.
Certificate lifetimes are shrinking (to 100 days from March 2027 and 47 days from March 2029), so renewals happen more often, and silent failures get more likely.
What the check covers
SSL certificate
Issuer, names covered, expiry date and days left, and whether browsers will trust it (expired, self-signed, wrong hostname, or an untrusted chain).
Silent renewal failures
Automatically renewed certificates (Let's Encrypt, ZeroSSL, Google Trust Services, Buypass) that are more than 75% through their lifetime, a sign the renewal has stopped working.
Root and www
Both example.com and www.example.com are checked, so a name that's broken or not covered by the certificate is caught.
Domain registration
Registrar and expiry date from the official registry (RDAP). Some country domains don't publish this.
CAA records
DNS records that would stop the current certificate authority from issuing the next renewal.
Host and CDN
A best guess at where each site is hosted, from DNS and the IP address owner.
We only connect to port 443 to read the certificate. We never load page content. Private and internal addresses are blocked.
Get early access to automatic monitoring
Dewline will check your client sites every day and warn you before a certificate or domain lapses. Join the early-access list and help shape it.