47-day TLS certificates are coming. Here's a single-file HTML tool to keep track of them

说明与用途

CertScope 是一个离线 HTML 工具，可解析 TLS 证书、跟踪短生命周期、标记自动续期失败，并生成提醒和报告。

问题

Shortening TLS certificate lifetimes to 47 days means many manual‑renewed certificates will need frequent updates, but automation tools often miss devices like FortiGate VPNs, Synology NAS, Exchange servers, internal CAs, and failing auto‑renewal jobs.

结果

CertScope enables teams to track short‑lived TLS certificates, detect failed auto‑renewals, and generate reminders, reducing manual oversight and preventing certificate expiry.

工作流

• Paste or drop a PEM/CRT/CER/DER file into the browser page.
• The embedded DER/ASN.1 reader extracts validity, subject, issuer, SANs, key type and fingerprint.
• If a full chain is pasted, only the server certificate is kept and renewals are detected by matching CN and later expiry.
• The tool calculates a warning period (one‑third of lifetime, capped at 30 days) and flags certificates entering the warning window if marked auto‑renewed.
• Domains with registrar and expiry are linked to their certificates.
• An .ics file is generated for Outlook or Google Calendar reminders.
• Optional PDF, CSV, JSON backups and undo/redo are available.
• The page runs offline with a strict Content‑Security‑Policy, so no external libraries or network access are required.
• The tool does not perform network scans or renewals; it only reports what needs attention.

证据

In April 2025 the CA/Browser Forum voted to shorten public TLS certificate lifetimes: 200 days since March 2026, 100 days from March 2027 and 47 days from March 2029.

来源

Automation (ACME, certbot, win-acme) handles most of it. But there's always the leftover: the FortiGate VPN cert installed by hand, the Synology NAS, the Exchange server that needs a cmdlet after every renewal, the internal CA, and the auto-renewal job that silently stopped working three months ago.

来源

CertScope is the fourth tool in the Scope family (after RackScope, SubnetScope and AssetScope): an inventory of certificates and domains in a single index.html.

来源

Paste the PEM (or drop a .pem, .crt, .cer, .der) and the record fills itself: CN, SANs, issuer, dates, key type, serial and SHA-256 fingerprint.

来源

The page ships with a connect-src 'none' Content-Security-Policy, so no CDN and nothing leaves the machine.

来源