Certificate Monitor

Desktop TLS/SSL certificate monitoring with expiry tracking, grading and alerts

SoftPerfect Certificate Monitor is a free desktop application that keeps track of TLS/SSL certificates on the hosts you specify. It connects to each host, retrieves the certificate and its chain, and evaluates the overall health with a letter grade from A (excellent) to F (critical). You can see at a glance which certificates are about to expire, which have weak configurations, and which are perfectly healthy.

Unlike online certificate-checking services, Certificate Monitor runs entirely on your computer. Your list of monitored domains never leaves your machine, and you can monitor internal servers, private networks and self-signed services that are not reachable from the internet. The application runs on Windows, macOS and Linux, stores all data in a local SQLite database, and requires no account, subscription or external service.

Key features

Certificate health grading — Each host receives a letter grade (A–F) based on certificate validity, expiry proximity, chain completeness and key strength.
Expiry tracking — See exactly how many days remain before each certificate expires, with colour-coded warnings as deadlines approach.
Full chain inspection — View the complete certificate chain from leaf to root, including issuer, SANs, serial number, fingerprint and key details.
Desktop notifications — Get notified when a certificate is about to expire, has already expired, or when a connection error occurs.
Two view modes — A sortable table view for detailed monitoring, and a tile view for a compact visual overview.
Private and internal hosts — Monitor internal servers, intranet services and private networks that online tools simply cannot reach.
Complete privacy — Everything runs locally. No data is sent anywhere — your domain list and certificate details stay on your PC.
Cross-platform — Windows (64-bit, ARM64), macOS, and Linux.

Where Certificate Monitor is useful

Web hosting and agencies — Track certificate expiry across dozens or hundreds of client domains. Catch renewals before they lapse and cause browser warnings.
DevOps and infrastructure — Monitor certificates on load balancers, API gateways, microservices and CI/CD endpoints, including internal ones behind firewalls.
System administration — Keep an eye on mail servers, VPNs, LDAP services and any other TLS-enabled infrastructure within your organisation.
Security and compliance — Verify that certificates use strong keys and trusted chains. Spot weak configurations before they become audit findings.
Self-hosting and home labs — Monitor certificates on your own servers, NAS devices and home automation services without exposing them to third parties.
Privacy-conscious monitoring — Unlike cloud-based scanners, your domain names and certificate details are never uploaded or shared with anyone.