Start with the certificate a public hostname actually serves: check its validity dates, name and chain with the opt-in external scan. Use the local CSR generator for a new request; use the date planner only as a secondary renewal aid.
TLS certificates contain a start time (notBefore) and an end time (notAfter). A certificate can be outside its validity window even if the displayed expiry date appears to be in the future. Check the system clock and the full timestamp, including timezone, when diagnosing date errors.
Set a 14, 30, 60 or 90-day planning window and compare it with an expiry date obtained from your approved certificate viewer or monitoring system. The result is a one-time calculation, not a reminder or inventory. Confirm the owner, renewal process and deployment path; renewal at the certificate authority alone does not guarantee the new certificate is installed everywhere.
A date calculation cannot confirm hostname matching, trusted issuers, intermediate certificates, revocation, TLS protocol settings or which certificate a load balancer currently serves. Test the intended hostname and port with an approved browser or TLS diagnostic from the relevant network, then inspect the result and certificate chain.
Public certificates may be shared for diagnosis; their associated private keys must stay secret. Never paste private-key material, passwords, customer configuration or internal host details into a public tool or enquiry. Rotate a key if it was exposed, following your organisation's incident process.
CAA records can express which certificate authorities a domain authorizes. The issuewild property has separate scope for wildcard names and takes precedence over issue for those names when present. The issuemail property concerns email-protection certificates, not ordinary web-server certificates. The DNS checker can optionally search up to eight parent names and stop at the nearest returned CAA record. It reports aliases and lookup failures as incomplete; delegation, caching and CA-specific behavior can still affect the result. Record presence does not prove that a served certificate is correct. Confirm the required names and issuance process with your CA before changing policy. See RFC 8659 and RFC 9495.
The expiry planner compares a date with a lead time you select. It does not save or schedule reminders, fetch a domain, inspect a live certificate, verify a certificate chain, or change any certificate. The entered date stays in your browser. For a production incident or renewal, validate the actual endpoint using your approved monitoring and change process.
Generate a PKCS#10 certificate signing request and matching passphrase-encrypted private key locally in the browser. The key is not uploaded to Cloudek. Download both artifacts, keep the passphrase separate, and confirm required fields and algorithms with your certificate authority before use.
Enter its public hostname in the website SSL/TLS helper. Cloudek prepares an opt-in link to the separate Qualys SSL Labs service. The hostname is sent to that provider only if you open the link; this checks the public TLS endpoint, not the entire website or application.
Certificates already expose their not-before and not-after validity dates. If you have the expiry date, the local helper can calculate a chosen lead-time milestone; it does not monitor the site or send reminders. Check the actual public endpoint first when troubleshooting a live deployment.
