Platform
Certificate expiry and website security monitoring
Certificate and website monitoring watches every web asset discovery finds. EASMLens reports certificates that have expired or expire within 21 days, sites still served over plain HTTP, and the performance and indexability problems that make a public website both less secure and harder to find.
The outage nobody saw coming was in the calendar
An expired certificate takes a service offline as surely as an attack, and it usually happens on a host nobody remembered owning. Main websites are watched; the API gateway, the customer portal in another region and the supplier-hosted microsite often are not.
Public websites also leak risk through poor hygiene: pages still served over HTTP, old frameworks, slow responses that hint at overloaded or forgotten infrastructure.
How EASMLens does it
- 1
Collect every certificate
Certificates come from your hosts and from certificate transparency logs, so certificates issued for names you did not know about are seen too.
- 2
Check expiry and configuration
Each host is checked for expired certificates, certificates expiring within 21 days and plain HTTP service.
- 3
Measure website quality
Web assets are checked for response time to first byte, HTTP/2, indexability and on-page signals, which also reveals sites that should not be public.
- 4
Alert and report
Expiring certificates and new issues are reported with the host, issuer and dates, in time to renew.
What it checks
Certificate expiry
Expired certificates and those within 21 days of expiry.
Plain HTTP
Sites reachable only over HTTP, or not redirecting to HTTPS.
Protocol support
Whether each site supports HTTP/2.
Response time
Time to first byte, measured without counting redirects.
Indexability
Whether pages can be indexed, and staging sites that are publicly indexable when they should not be.
Certificate transparency
Certificates issued for your names that you may not have requested.
What you get
- An expiry calendar of every certificate on every discovered host
- Findings for sites still served over plain HTTP
- Website quality scores per web asset
- Alerts before a certificate expires
Where it helps
- Availability
- Avoid the outage caused by a certificate on a host nobody was watching.
- Compliance evidence
- Show that encryption in transit is in place across the internet-facing estate, not just the main site.
- Marketing and digital teams
- Find forgotten microsites and staging sites that hurt both security and search visibility.
EASMLens discovers your attack surface from DNS, certificate transparency, internet-wide scan datasets and public records, then runs non-destructive checks against the assets in your scope. It never attempts exploitation. It provides discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- Why 21 days?
- It leaves enough time to renew through a change process. Certificates on automated renewal rarely reach the threshold, so a warning usually means automation has failed.
- Do you monitor certificates we did not request?
- Yes. Certificate transparency logs show every publicly trusted certificate issued for your names, which can reveal shadow IT or a mis-issued certificate.
- Why include website quality in a security product?
- Because the same checks find forgotten sites. A slow, unmaintained or wrongly indexed site is often an unowned one, and unowned sites are where vulnerabilities sit unpatched.
Related capabilities
Attack surface discovery
Find every internet-facing domain, subdomain, IP, certificate, cloud service and API attributed to you, including shadow IT nobody told security about.
External vulnerability scanning
Non-destructive checks on every internet-facing asset you own: exposed services, known vulnerabilities, end-of-life software and risky configurations.
Dangling DNS and subdomain takeover
Find CNAME records pointing at cloud resources that no longer exist, before someone claims the resource and serves content on your subdomain.