From March 2026, certificates max out at 200 days — and 47 by 2029. That's up to 8× more renewals, each one a chance to fail silently. QuietLS watches what your reverse proxy can't see: CT logs, renewal failures, header drift, DNS health. Auto-renewal included.
Want it watched continuously? Start free.
Hosted in Germany · Your private keys stay on your servers · Free tier, no credit card.
Enter a domain and we'll run the same checks we run on monitored sites — SSL, TLS, headers, DNS, and Certificate Transparency. No account, no email gate.
You’re a developer, not a security specialist. You don’t need another dashboard — you need someone watching these four things so you don’t have to.
Your reverse proxy renews SSL automatically — until it doesn't. A rotated API key, a failed DNS-01 challenge, and the cert expires before anyone notices. 67% of organizations already hit certificate-related outages every month (CyberArk) — and with lifetimes shrinking to 47 days by 2029, every renewal is another chance to fail silently.
QuietLS · Detects renewal failures days before expiry, regardless of what’s renewing.
You manage 20 domains for clients, tracked in a spreadsheet. That worked at one renewal a year. At 200-day — soon 47-day — lifetimes it’s up to 8× more renewals, and the one nobody remembers to check expires Monday morning. The client sees it before you do. That’s a lost retainer.
QuietLS · Every domain on one watchlist.
Someone weakened your CSP in a Friday deploy. You don’t find out until Thursday, when a security researcher emails you about it. Security Misconfiguration is now #2 in the OWASP Top 10 (2025) — found in roughly 9 out of 10 applications tested. Yours is probably one of them.
QuietLS · Header changes flagged the same day.
Someone — or some bot — issued a certificate for your domain from a CA you’ve never used. Most owners learn they’ve been compromised from a browser warning or a blocklist, weeks after the fact — because nobody reads Certificate Transparency logs at 2 AM. That’s the earliest attack signal you’re missing.
QuietLS · CT logs scanned for you, under a minute.
QuietLS watches all four — quietly, on a schedule, with a deterministic A–F score. No black box, no dashboards you have to remember to open.
[CT log] QuietLS detected a Sectigo certificate issued for stripe-api.example.com — a subdomain the team never authorized.
[alert] customer notified in 47 seconds via Discord webhook · investigation link attached
Most site owners learn they've been compromised from a browser warning or a blocklist — weeks after the fact. CT log monitoring is one of those things you mean to set up; by the time you do, the unauthorized cert has been valid for weeks. We watch every CT log entry for every domain you own — automatically, from day one.
External monitoring your reverse proxy can’t see, silent-failure detection, and auto-renewal — in that order of priority.
CT logs, security headers drift, DNS health, and a deterministic A–F score — continuously, not just when you remember to check. The thing your reverse proxy can’t see.
Your reverse proxy renews automatically — until it doesn't. Shorter cert lifetimes mean up to 8× more renewals — and 8× more chances to break silently. We detect renewal breakage days before expiry, regardless of what's renewing — and you hear about it by email and Discord.
No reverse proxy doing renewal? We do it. Let’s Encrypt, ZeroSSL, Sectigo, DigiCert — ACME DNS-01 and HTTP-01, in-place install via agent or hooks.
Domain score
Add a Content-Security-Policy header to improve your score from C to A.
For the full check catalogue and scoring methodology, see the documentation. The agent that runs on your servers is open source (Apache-2.0) — read every line before you install it.
Most self-hosters reach for Uptime Kuma, SSL Labs, or cron + certbot first. Each solves part of the problem. Here’s the gap.
| Capability | Uptime Kuma | SSL Labs | cron + certbot | QuietLS |
|---|---|---|---|---|
| Cert expiry tracking | basic | manual | continuous | |
| CT log monitoring | ||||
| Headers drift | one-off | |||
| DNS health | ||||
| Auto-renewal | manual | |||
| A–F security score | one-off | deterministic |
Every plan includes the full set of monitoring checks. Plans differ by domain count, certificate authorities, and history depth.
Watch one domain. CT logs, headers, DNS, TLS — all checks. Renewal included if you need it.
For the side-project crowd watching a handful of domains — three domains, all the same checks.
then $2/extra domain
For indie devs who want commercial CAs, longer history, and the same observability across more domains.
then $2/extra domain
For teams that need white-label dashboards, webhooks, and multi-domain reports.
For agencies and MSPs managing many clients with on-call integrations.
Need more than 100 domains or a DPA? Contact us
Monthly or annual billing. No credit card on Free. Cancel anytime, and export your data whenever you want.
Built for developers who already automated SSL — and want to know when the automation lies to them.
1–5 domains · Vercel / Railway / Fly.io
Vercel, Railway, and Fly handle SSL. We watch what they don't: who else is issuing certs on your domain, whether your headers got weakened in last Friday's deploy, whether your DNS is drifting.
5–15 domains · Homelab
Caddy and Traefik renew your certs. We tell you when something silent breaks — your CT log shows an unauthorized cert, your subdomain CNAME is drifting toward a takeover, your headers regressed after an update. One A–F score, no Uptime Kuma sledgehammer.
Personal sites · Portfolio
A handful of domains you care about but don't want to babysit. Predictable cost, no surprises, the same monitoring quality as the larger plans.
1–5 people · Client domains
Automatic renewals so a missed expiry never becomes a lost contract. Per-domain reports you can attach to a deliverable. One less thing to track across clients.
Unauthorized certificate detected
Alert history
Adapted from real posts on X — names and services removed. The people we built QuietLS for, before they ever heard of it.
“An agency owner messaged me: client site down, 11pm Friday. The SSL had expired three days earlier. The registrar’s warnings went to a billing inbox nobody had opened in months. He found out when a customer complained.”
agency founder, on X
“CPU normal. Memory normal. Database healthy. But nobody could log in — an expired certificate. Monitoring your infrastructure isn’t enough. You have to monitor trust, too.”
backend engineer, on X
“The cert expired three hours ago. You never got the renewal email. The person who set it up left months back, and nobody knows where it was bought. Customers are seeing security warnings. Where do you even start?”
developer, on X
“The TLS cert was expired for about 35 hours. Nothing says “trust us” like a browser full of red warnings. It wasn’t even an outage — just a hygiene faceplant.”
sysadmin, on X
I've been shipping code professionally since 2018 — building distributed services for large platforms by day, indie SaaS on the side. Mostly TypeScript, Node.js, and PostgreSQL, often wrestling with infrastructure other people should have owned but didn't. QuietLS exists because I was tired of automation that fails quietly — silent renewal breakage, CT logs nobody watches, headers that drift after a deploy. I built it for people like me — who ship their own thing and want SSL + security monitoring to just work.
Transparency builds trust. Here is what you are really getting.
Honestly: this is not enterprise-grade. If you need SOC 2 Type II, audit trails for regulators, or a vendor risk assessment form — go to Keyfactor or Venafi. They are excellent products built for that world.
If you need SSL to quietly work while you focus on your product — I built this for you.
Still have questions? Contact support or browse the documentation.
Free forever for 1 domain. No credit card. Upgrade when you need more.
The 2026 backdrop