QuietLS continuously monitors what your reverse proxy can't see: Certificate Transparency logs, silent renewal failures, security headers drift, DNS health. Plus auto-renewal, included.
Built by D. Spivak, a developer who got tired of automation that fails quietly.
Want it watched continuously? Start free.
Hosted in Germany · Your private keys stay on your servers · Free tier, no credit card.
Enter a domain and we'll run the same checks we run on monitored sites — SSL, TLS, headers, DNS, and Certificate Transparency. No account, no email gate.
You don’t need another dashboard. You need someone watching these four things so you don’t have to.
Your reverse proxy renews SSL automatically — until it doesn't. The Cloudflare API key got rotated, the DNS-01 challenge fails silently, and you find out 14 days later when the cert is already expired and customers are calling.
QuietLS · Detects renewal failures days before expiry, regardless of what’s renewing.
You manage 20 domains for clients. One of them — the one nobody remembers to check — has an expired cert come Monday morning. The client sees it before you do. That’s a lost retainer.
QuietLS · Every domain on one watchlist.
Someone weakened your CSP in a Friday deploy. You don’t find out until Thursday, when a security researcher emails you about it. The vulnerability was live for six days.
QuietLS · Header changes flagged the same day.
Someone — or some bot — issued a certificate for your domain from a CA you’ve never used. You never notice, because nobody reads Certificate Transparency logs at 2 AM. That’s the earliest attack signal you’re missing.
QuietLS · CT logs scanned for you, under a minute.
QuietLS watches all four — quietly, on a schedule, with a deterministic A–F score. No black box, no dashboards you have to remember to open.
[CT log] QuietLS detected a Sectigo certificate issued for stripe-api.example.com — a subdomain the team never authorized.
[alert] customer notified in 47 seconds via Discord webhook · investigation link attached
Most CT log monitoring is one of those things you mean to set up. By the time you do, the unauthorized cert has been valid for weeks. We watch every CT log entry for every domain you own — automatically.
External monitoring your reverse proxy can’t see, silent-failure detection, and auto-renewal — in that order of priority.
CT logs, security headers drift, DNS health, and a deterministic A–F score — continuously, not just when you remember to check. The thing your reverse proxy can’t see.
Your reverse proxy renews automatically — until it doesn't. We detect renewal breakage days before expiry, regardless of what's renewing.
No reverse proxy doing renewal? We do it. Let’s Encrypt, ZeroSSL, Sectigo, DigiCert — ACME DNS-01 and HTTP-01, in-place install via agent or hooks.
For the full check catalogue and scoring methodology, see the documentation.
Most self-hosters reach for Uptime Kuma, SSL Labs, or cron + certbot first. Each solves part of the problem. Here’s the gap.
| Capability | Uptime Kuma | SSL Labs | cron + certbot | QuietLS |
|---|---|---|---|---|
| Cert expiry tracking | basic | manual | continuous | |
| CT log monitoring | ||||
| Headers drift | one-off | |||
| DNS health | ||||
| Auto-renewal | manual | |||
| A–F security score | one-off | deterministic |
Built for developers who already automated SSL — and want to know when the automation lies to them.
1–5 domains · Vercel / Railway / Fly.io
Vercel, Railway, and Fly handle SSL. We watch what they don't: who else is issuing certs on your domain, whether your headers got weakened in last Friday's deploy, whether your DNS is drifting.
5–15 domains · Homelab
Caddy and Traefik renew your certs. We tell you when something silent breaks — your CT log shows an unauthorized cert, your subdomain CNAME is drifting toward a takeover, your headers regressed after an update. One A–F score, no Uptime Kuma sledgehammer.
Personal sites · Portfolio
A handful of domains you care about but don't want to babysit. Predictable cost, no surprises, the same monitoring quality as the larger plans.
1–5 people · Client domains
Automatic renewals so a missed expiry never becomes a lost contract. Per-domain reports you can attach to a deliverable. One less thing to track across clients.
Adapted quotes from r/selfhosted threads — the segment we’re aiming at, before they ever heard of QuietLS.
“I wanted a self-hosted CT log monitor without the Uptime Kuma overhead.”
r/selfhosted
“35 LXCs and VMs, certs are pets not cattle, getssl works but I’m tired of checking on it.”
r/selfhosted
I've been shipping code professionally since 2018 — building distributed services for large platforms by day, indie SaaS on the side. Mostly TypeScript, Node.js, and PostgreSQL, often wrestling with infrastructure other people should have owned but didn't. QuietLS exists because I was tired of automation that fails quietly — silent renewal breakage, CT logs nobody watches, headers that drift after a deploy. I built it for people like me — who ship their own thing and want SSL + security monitoring to just work.
Transparency builds trust. Here is what you are really getting.
Honestly: this is not enterprise-grade. If you need SOC 2 Type II, audit trails for regulators, or a vendor risk assessment form — go to Keyfactor or Venafi. They are excellent products built for that world.
If you need SSL to quietly work while you focus on your product — I built this for you.
Every plan includes the full set of monitoring checks. Plans differ by domain count, certificate authorities, and history depth.
Watch one domain. CT logs, headers, DNS, TLS — all checks. Renewal included if you need it.
$90 billed annually
For indie devs who want commercial CAs, longer history, and the same observability across more domains.
$290 billed annually
For teams that need white-label dashboards, webhooks, and multi-domain reports.
$990 billed annually
For agencies and MSPs managing many clients with on-call integrations.
Need more than 100 domains or a DPA? Talk to the founder
Monthly or annual billing. No credit card on Free. Cancel anytime — I'll even help you export your data.
Still have questions? Contact support or browse the documentation.
Free forever for 1 domain. No credit card. Upgrade when you need more.
