# Radardue

> Radardue tracks expiry dates for TLS certificates, domain registrations and renewals (licenses, warranties, contracts) across many clients, and alerts the team by email, Slack, Discord, Telegram or webhook before anything lapses. It is built for managed service providers (MSPs), IT teams and web agencies.

- Website: https://radardue.com
- Pricing: Free (25 items), Team $19/month (150), MSP $49/month (750), Agency $99/month (2,500). Unlimited clients and teammates on every plan.
- Finds hostnames from public Certificate Transparency logs, checks the certificate each host actually serves (any TLS port), reads domain expiry over RDAP, and flags hosts whose renewal habits will break with 64-day and 47-day certificates.
- Support: hello@radardue.com

---

# Getting started

Radardue keeps one list of every TLS certificate, domain registration and renewal across the clients you look after, and tells your team before anything lapses. This page takes you from sign-up to your first alert.

## 1. Create your account

[Sign up](https://radardue.com/signup) with your work email. The Free plan tracks up to 25 items with every alert channel, and needs no card.

Two things are set up for you: the address you signed up with becomes an **email alert channel**, and you get a first client called **My company**. Rename or delete it whenever you like.

## 2. Add a client for each customer

In the sidebar, next to **Clients**, click **+ Add** and type the customer's name. Clients keep each customer's items, reports and alert channels separate. There's no limit on clients on any plan.

## 3. Add what to watch

Open a client. The **Add** panel has four tabs:

- **Discover a domain.** Type `example.com` and Radardue lists every hostname under it that has had a public certificate. Tick the ones to watch. See [Certificates & domains](https://radardue.com/docs/certificates-and-domains).
- **Host & port.** One hostname, with a port if it isn't 443, for example `mail.example.com:465`.
- **License or renewal.** Anything with a date: Microsoft 365 seats, firewall licenses, warranties, support contracts.
- **Bulk import.** Paste a list of hosts and renewals in one go. See [Import, export & calendar](https://radardue.com/docs/import-export).

Certificates and domains are checked straight away and then every day. Renewals use the date you enter.

## 4. Connect your alerts

Go to [Alert channels](https://radardue.com/app/settings). Email is already there; add Slack, Discord, Telegram or a webhook so alerts land where your team works, then click **Send test**. Step-by-step setup for each is in [Alert channels](https://radardue.com/docs/alert-channels).

## 5. Read the overview

The [Overview](https://radardue.com/app) shows every client at once:

- **Status cards** count what's expired, due within 7 days, due within 30 days, failing its check, and healthy.
- **Next 90 days** plots what's coming up on a timeline.
- **The list** is sorted by due date. Use the tabs (Needs attention, TLS, Domains, Renewals) and the search box to narrow it down.

> **Tip:** invite the people who share on-call duty from the [Team](https://radardue.com/app/team) page. Teammates are free on every plan.

Source: https://radardue.com/docs/getting-started

---

# Certificates & domains

Radardue only uses public information: the certificate a server actually presents, public Certificate Transparency logs, and domain registry data. Nothing to install, and no access to your clients' systems.

## Finding every hostname

**Discover a domain** searches public Certificate Transparency logs for every hostname under that domain that has had a publicly trusted certificate, then shows the list so you can pick what to watch. Wildcard certificates show up as the domain they cover. The results also offer to watch the domain's registration.

Up to 200 hostnames are shown per search. Hosts that only use a private or internal certificate authority won't appear in the logs; add those by hand if they're reachable from the internet.

## What a certificate check does

Radardue connects to the host on its port (443 unless you give another), does a normal TLS handshake for that hostname, and reads the certificate the server actually sends. From it we record:

- the expiry date and the date it was issued,
- the issuer (for example Let's Encrypt or Sectigo),
- whether the certificate and its chain validate for that hostname.

Because it checks what's being served, it catches the common failure where a certificate was renewed but never deployed.

### Other ports

Add `host:port` for anything that speaks TLS from the first byte: `mail.example.com:465` (SMTPS), `:993` (IMAPS), `vpn.example.com:8443` and so on. Ports that upgrade with STARTTLS, such as 25 and 587, aren't supported yet.

### Public hosts only

Checks run from our servers on the public internet. Hostnames that resolve to private or internal addresses are refused, so Radardue can't be used to probe internal networks.

## Domain registrations

For domains, Radardue reads the expiry date and registrar from the registry over RDAP, the modern replacement for WHOIS. When you add hosts in bulk you can also watch each host's registrable domain, for example `acme.co.uk` for `shop.acme.co.uk`.

A few country-code registries don't publish RDAP. If a domain shows a failed check for that reason, add it as a **License or renewal** with its expiry date instead.

## How often things are checked

Every certificate and domain is checked again about once a day. To check one right away, open it and click **Check now**.

## Statuses

| Status | Meaning |
| --- | --- |
| Healthy | More than 30 days left, and for certificates the chain validates. |
| Due soon | Expires within 30 days. |
| Critical | Expires within 7 days. |
| Expired | The expiry date has passed. |
| Problem | The last check failed (for example the host didn't answer), or the certificate doesn't validate for the hostname. |
| Checking | Just added; the first check hasn't finished yet. |

## Item details

Click any item to see its full details: issuer, chain, the last check, any error, and the **certificate history** Radardue has seen for that host. You can add notes (who renews it, where the login lives), move it to another client, and for renewals change the name or date. Changing a renewal's date clears any snooze.

Source: https://radardue.com/docs/certificates-and-domains

---

# Alerts & schedule

The schedule is the same for every item, so nobody has to configure reminders. Alerts get louder as the date gets closer, and stop once someone has it in hand.

## The schedule

| When | What happens |
| --- | --- |
| 30 and 14 days before | One alert each. |
| Final 7 days | An alert every day until someone snoozes it. |
| On the day | An alert saying it expires today. |
| After expiry | A daily reminder for up to a week, then Radardue stops. |

Alerts are worked out every few minutes, so a newly added item that's already close to its date alerts straight away.

## What an alert says

The subject names the client, the item and the time left, for example `[Acme Dental] shop.acme-dental.com expires in 7 days`. The body adds the type, the exact date, the issuer or registrar, and a link to the item in Radardue.

## Snoozing

When someone is dealing with a renewal, open the item and click **Snooze alerts** (it appears within 30 days of expiry). Alerts for that item pause until **3 days before** the date, then come back as a final check.

A snooze belongs to one expiry date. Once the certificate is renewed or you change a renewal's date, the new date is watched from scratch; there's nothing to un-snooze.

## Who gets alerts

Every alert channel on the account receives alerts for every client, except channels limited to one client, which only receive that client's alerts. That lets you send a customer's alerts to their own Slack or Discord while your team still sees everything. See [Alert channels](https://radardue.com/docs/alert-channels).

If none of the channels accept an alert (for example a webhook is down), Radardue tries again on the next run.

## Weekly summary

Each person can turn on a Monday email under [Account → Weekly summary](https://radardue.com/app/account). It lists everything due in the next 30 days plus any failing checks, across all clients. It's sent from 07:00 UTC on Mondays.

Source: https://radardue.com/docs/alerts

---

# Alert channels

Send alerts wherever your team already looks. Add channels under [Alert channels](https://radardue.com/app/settings), then use **Send test** to make sure each one works.

## Slack

1. In Slack, open **Apps**, find **Incoming Webhooks** and add it to your workspace.
2. Pick the channel alerts should go to, then copy the webhook URL. It starts with `https://hooks.slack.com/services/`.
3. In Radardue, choose **Slack**, paste the URL and click **Add channel**.

## Discord

1. In Discord, open the channel's settings and go to **Integrations → Webhooks**.
2. Click **New Webhook**, give it a name, and **Copy Webhook URL**. It starts with `https://discord.com/api/webhooks/`.
3. In Radardue, choose **Discord**, paste the URL and add the channel.

## Telegram

1. In Telegram, message **@BotFather**, send `/newbot` and follow the steps. Copy the bot token it gives you (it looks like `123456789:AA…`).
2. Send your new bot any message, or add it to the group that should get alerts and post a message there.
3. Open `https://api.telegram.org/bot<token>/getUpdates` in a browser, with your token in place of `<token>`. Find `"chat":{"id": …}` in the reply. Group chat IDs start with a minus sign.
4. In Radardue, choose **Telegram**, paste the token and the chat ID, and add the channel.

## Email

Any address or distribution list works, such as `oncall@yourcompany.com`. The address you signed up with is added automatically, and so is each teammate's address when they join. Remove any you don't want.

## Webhook

Give Radardue any HTTPS URL and it will POST a JSON message for each alert, ready for your own scripts, a PSA or ticketing tool, or an automation platform. The format is in the [webhook reference](https://radardue.com/docs/webhooks).

## Channels for one client

When adding a channel, **Send alerts for** lets you pick a single client. That channel then only receives that client's alerts, which is handy for posting into a customer's own Slack or Discord. Channels left on **All clients** receive everything.

An account can have up to 25 channels.

## Testing and removing

**Send test** sends a sample message right away and tells you if the platform rejected it. If a test fails, check the URL or token was copied in full. To stop a channel, click the bin icon next to it.

> **Keep URLs private.** Anyone with a Slack or Discord webhook URL can post to that channel, so treat them like passwords.

Source: https://radardue.com/docs/alert-channels

---

# Webhook reference

A webhook channel receives every alert as a JSON `POST`. Use it to open tickets, page someone, or feed your own dashboards.

## The request

- Method `POST`, header `Content-Type: application/json`.
- Sent from Radardue's servers to the HTTPS URL you saved.
- Any `2xx` response within 30 seconds counts as delivered. Anything else counts as a failure.

## Example

```json
{
  "event": "expiry.alert",
  "subject": "[Acme Dental] shop.acme-dental.com expires in 7 days",
  "text": "TLS certificate for shop.acme-dental.com (Acme Dental) expires in 7 days, on Mon 19 Oct 2026.\nIssuer/registrar: Let's Encrypt (R11)\n\nOpen in Radardue: https://radardue.com/app/items/42 …",
  "source": "radardue.com",
  "item": {
    "id": 42,
    "type": "certificate",
    "name": "shop.acme-dental.com",
    "port": 443,
    "client": "Acme Dental",
    "client_id": 7,
    "expires_at": "2026-10-19T09:12:44Z",
    "days_left": 7,
    "issuer": "Let's Encrypt (R11)",
    "url": "https://radardue.com/app/items/42"
  }
}
```

## Fields

| Field | Type | Description |
| --- | --- | --- |
| `event` | string | `expiry.alert` for real alerts, `test` for the Send test button. |
| `subject` | string | One-line summary, the same as the email subject. |
| `text` | string | Plain-text body, the same as the email body. |
| `source` | string | Always `radardue.com`. |
| `item.id` | number | Stable ID of the tracked item. |
| `item.type` | string | `certificate`, `domain` or `renewal`. |
| `item.name` | string | Hostname, domain, or the renewal's name. |
| `item.port` | number | Certificates only. The port that was checked. |
| `item.client` | string | Client name. |
| `item.client_id` | number | Stable ID of the client. |
| `item.expires_at` | string | Expiry time in UTC, RFC 3339. |
| `item.days_left` | number | Whole days until expiry; negative once expired. |
| `item.issuer` | string | Certificate issuer or domain registrar, when known. |
| `item.url` | string | Link to the item in Radardue. |

Test messages have `"event": "test"` and no `item`.

## Good to know

- **One item, several alerts.** An item alerts at each step of the [schedule](https://radardue.com/docs/alerts) and daily in its final week. If you open tickets, use `item.id` together with `item.expires_at` as the key so you update one ticket instead of creating new ones.
- **Securing your endpoint.** Requests aren't signed yet. Put a long random token in the URL path or query string and reject requests without it.
- **Stability.** We only ever add fields to this payload. Ignore fields you don't recognise.

Source: https://radardue.com/docs/webhooks

---

# Import, export & calendar

Bring an existing spreadsheet in, take everything out as CSV, and see every expiry date in the calendar you already use.

## Bulk import

Open a client, choose the **Bulk import** tab and paste one item per line. Everything goes into that client.

```
# Lines starting with # are ignored
www.acme-dental.com
https://shop.acme-dental.com/checkout
mail.acme-dental.com:465
Microsoft 365 Business, 2026-11-07, 12 seats via Pax8
FortiGate 60F license, 2027-01-15
```

- **Hostnames** are watched as certificates on port 443. Full URLs are fine; only the hostname is kept.
- **`host:port`** watches another port, as described in [Certificates & domains](https://radardue.com/docs/certificates-and-domains).
- **`Label, YYYY-MM-DD, note`** adds a renewal. The note is optional and may contain commas.
- Keep **Also watch each domain's registration** ticked to add each host's domain too.

Up to 1,000 lines at a time. Items the client already has are skipped, and Radardue tells you which lines it couldn't read. If an import would take you over your plan's item limit, nothing is imported and you're told by how much.

> **From a spreadsheet:** put the name in column A, the date as `YYYY-MM-DD` in column B and an optional note in column C, save as CSV, and paste the contents.

## CSV export

[Account → Export → Download CSV](https://radardue.com/app/account) gives you every item across all clients, with these columns:

```
client, type, name, port, expires, days_left, status,
issuer_or_registrar, notes, last_error
```

It opens in Excel, Numbers and Google Sheets. Cells that start with `=`, `+`, `-` or `@` are escaped so a spreadsheet never runs them as formulas.

## Calendar feed

Under [Account → Calendar feed](https://radardue.com/app/account), click **Create calendar link**. You get a private address that lists every expiry as an all-day event, with a reminder 14 days before. Subscribe to it once and it stays in sync:

- **Google Calendar:** Other calendars → **+** → From URL, then paste the link.
- **Outlook:** Add calendar → Subscribe from web, then paste the link.
- **Apple Calendar:** File → New Calendar Subscription, then paste the link.

Your calendar app decides how often it refreshes subscribed calendars; Google can take several hours.

Anyone with the link can read the dates, so share it carefully. If it leaks, click **Make a new link**: the old one stops working straight away.

Source: https://radardue.com/docs/import-export

---

# Teams & client reports

Share one list with everyone who looks after your clients, and show each client what's coming up for them.

## Inviting teammates

On the [Team](https://radardue.com/app/team) page, enter a teammate's email and click **Send invite**. They get a link that's valid for 7 days, choose a password, and land in the same account. Teammates are free on every plan.

Each new teammate's address is added as an email alert channel, so they get alerts from day one. Change that on [Alert channels](https://radardue.com/app/settings).

An email address can belong to one Radardue account. If someone already has their own login, invite a different address.

## Owner and members

| Who | Can do |
| --- | --- |
| Everyone | See and edit all clients and items, manage alert channels, snooze alerts, export, use the calendar feed and client reports. |
| Owner only | Invite and remove teammates, change the plan and payment details, set report branding, delete the account. |

Members can leave on their own from [Account](https://radardue.com/app/account). The data stays with the account.

## Client reports

Open a client and click **Client report**. You get a clean page listing that client's certificates, domains and renewals with their dates, issuers and notes, and any 2027 risks. Click **Print / save PDF** to send it as a PDF, or attach it to a QBR.

### Branding

- **MSP plan:** add your company name under [Account → Client report branding](https://radardue.com/app/account) and every report says "Prepared by" your company.
- **Agency plan:** reports carry only your name, with no Radardue branding at all.

Source: https://radardue.com/docs/teams-and-reports

---

# 2027 readiness

Certificates are getting shorter. Radardue looks at how each host renews today and flags the ones whose habits will break when they do.

## What's changing

| Date | Change |
| --- | --- |
| 15 Mar 2026 | Public certificates limited to 200 days. |
| 10 Feb 2027 | Let's Encrypt's default certificate lifetime drops to 64 days. |
| 15 Mar 2027 | Public certificates limited to 100 days. |
| 15 Mar 2029 | Public certificates limited to 47 days. |

The full timeline and a checklist are in our guide to [47-day certificates](https://radardue.com/guides/47-day-certificates).

## What Radardue checks

For each certificate, Radardue looks at when the host's previous certificates were issued (from its own daily checks and public Certificate Transparency logs) and works out the usual gap between renewals. The result appears on the item page and in client reports:

| Flag | Meaning |
| --- | --- |
| At risk | A Let's Encrypt host that renews on a fixed cycle of roughly 50 to 70 days. Once certificates last 64 days, a 60-day job leaves almost no margin, and one missed run means an outage. |
| Worth watching | A certificate valid for more than 100 days. That's usually renewed by hand, and will need renewing about four times as often from March 2027. |
| Looks fine | The host renews often enough, or the certificate is already within the 2027 limits. |
| Not enough history | Fewer than three renewals seen so far. Radardue keeps learning from its daily checks. |

## Clearing an "at risk" flag

- **Renew by time remaining, not on a fixed interval.** Configure the ACME client (certbot, acme.sh, Caddy, Traefik, cert-manager and so on) to renew when about a third of the lifetime is left, instead of every 60 days.
- **Use ARI if you can.** ACME Renewal Information lets the certificate authority tell your client when to renew. Recent versions of many clients support it.
- **Remove hard-coded schedules.** Look for cron jobs and scheduled tasks that renew on a fixed day count.

The flag updates on its own as Radardue sees the host renew on the new schedule.

Source: https://radardue.com/docs/readiness

---

# Plans & billing

One flat monthly price per account. Every plan includes unlimited clients and teammates, all alert channels, the weekly summary and the calendar feed. Plans differ by how many items you track and by report branding.

## Plans

| Plan | Price | Tracked items | Extras |
| --- | --- | --- | --- |
| Free | $0 | 25 | — |
| Team | $19 / month | 150 | — |
| MSP | $49 / month | 750 | Your company name on client reports |
| Agency | $99 / month | 2,500 | White-label client reports |

An item is one certificate, domain or renewal. Prices are in US dollars; sales tax or VAT is added at checkout where it applies. Payments are handled by Creem, our merchant of record.

## Upgrading and switching plans

Go to [Plan & billing](https://radardue.com/app/billing) (account owner only). The first upgrade opens a secure checkout. After that, switch between paid plans on the same page: moving up charges the prorated difference for the rest of the billing period, and moving down credits the unused part. You can't move to a plan that tracks fewer items than you already have.

## Cancelling

Click **Cancel subscription** on the billing page. You keep your plan until the end of the period you've paid for, then the account moves to Free and you're not charged again. Changed your mind? **Resume subscription** undoes it any time before then.

Nothing is deleted when you move to Free. If you track more than 25 items, they keep being checked, but you can't add new ones until you're under the limit.

## Invoices, receipts and cards

A receipt is emailed after every payment, and your payment history is listed on the billing page. To update your card or download invoices, click **Update card & invoices**.

## Refunds

If Radardue isn't right for you, email [hello@radardue.com](mailto:hello@radardue.com) within 14 days of your first payment for a full refund. Details are in the [refund policy](https://radardue.com/refund).

## Deleting your account

The owner can delete the account under [Account](https://radardue.com/app/account). Cancel any subscription first. Deleting removes every client, item, channel and team login, and can't be undone, so export a CSV first if you want a copy.

Source: https://radardue.com/docs/billing