# Certificates & domains

Radardue only uses public information: the certificate a server actually presents, public Certificate Transparency logs, and domain registry data. Nothing to install, and no access to your clients' systems.

## Finding every hostname

**Discover a domain** searches public Certificate Transparency logs for every hostname under that domain that has had a publicly trusted certificate, then shows the list so you can pick what to watch. Wildcard certificates show up as the domain they cover. The results also offer to watch the domain's registration.

Up to 200 hostnames are shown per search. Hosts that only use a private or internal certificate authority won't appear in the logs; add those by hand if they're reachable from the internet.

## What a certificate check does

Radardue connects to the host on its port (443 unless you give another), does a normal TLS handshake for that hostname, and reads the certificate the server actually sends. From it we record:

- the expiry date and the date it was issued,
- the issuer (for example Let's Encrypt or Sectigo),
- whether the certificate and its chain validate for that hostname.

Because it checks what's being served, it catches the common failure where a certificate was renewed but never deployed.

### Other ports

Add `host:port` for anything that speaks TLS from the first byte: `mail.example.com:465` (SMTPS), `:993` (IMAPS), `vpn.example.com:8443` and so on. Ports that upgrade with STARTTLS, such as 25 and 587, aren't supported yet.

### Public hosts only

Checks run from our servers on the public internet. Hostnames that resolve to private or internal addresses are refused, so Radardue can't be used to probe internal networks.

## Domain registrations

For domains, Radardue reads the expiry date and registrar from the registry over RDAP, the modern replacement for WHOIS. When you add hosts in bulk you can also watch each host's registrable domain, for example `acme.co.uk` for `shop.acme.co.uk`.

A few country-code registries don't publish RDAP. If a domain shows a failed check for that reason, add it as a **License or renewal** with its expiry date instead.

## How often things are checked

Every certificate and domain is checked again about once a day. To check one right away, open it and click **Check now**.

## Statuses

| Status | Meaning |
| --- | --- |
| Healthy | More than 30 days left, and for certificates the chain validates. |
| Due soon | Expires within 30 days. |
| Critical | Expires within 7 days. |
| Expired | The expiry date has passed. |
| Problem | The last check failed (for example the host didn't answer), or the certificate doesn't validate for the hostname. |
| Checking | Just added; the first check hasn't finished yet. |

## Item details

Click any item to see its full details: issuer, chain, the last check, any error, and the **certificate history** Radardue has seen for that host. You can add notes (who renews it, where the login lives), move it to another client, and for renewals change the name or date. Changing a renewal's date clears any snooze.

Source: https://radardue.com/docs/certificates-and-domains