Certificate expiry
Every X.509 certificate carries a validity window: notBefore and notAfter. TLSWatch computes a whole-day countdown from “now” to notAfter (negative if already past).
Informational urgency bands
- expired — daysLeft < 0
- critical — fewer than 7 days
- soon — fewer than 30 days
- watch — fewer than 90 days
- ok — 90 days or more
These bands are countdown labels for operators learning certificate hygiene. They are not a security rating, audit result, or compliance statement. A certificate inside its validity window is not by itself an audit result or risk clearance.
Common gotchas
- Short-lived certificates (e.g. ~90-day ACME) will often land in watch even when automation is healthy.
- Clock skew between your laptop and the server can change perceived daysLeft by a day.
- notBefore in the future means the leaf is not yet valid on this clock.