47-day TLS certificates are coming. Here's a single-file HTML tool to keep track of them

In April 2025 the CA/Browser Forum voted to shorten public TLS certificate lifetimes: 200 days since March 2026, 100 days from March 2027 and 47 days from March 2029. A certificate you used to renew once a year will soon need renewing every few weeks.

Automation (ACME, certbot, win-acme) handles most of it. But there's always the leftover: the FortiGate VPN cert installed by hand, the Synology NAS, the Exchange server that needs a cmdlet after every renewal, the internal CA, and the auto-renewal job that silently stopped working three months ago.

CertScope is the fourth tool in the Scope family (after RackScope, SubnetScope and AssetScope): an inventory of certificates and domains in a single index.html.

What it does

• Paste the PEM (or drop a .pem, .crt, .cer, .der) and the record fills itself: CN, SANs, issuer, dates, key type, serial and SHA-256 fingerprint. Paste a full chain and it keeps only the server certificate. Same CN, later expiry → recorded as a renewal.
• Warning period based on the certificate's lifetime: a third of it, capped at 30 days. A 47-day cert warns 16 days ahead, a 90-day one 30 days ahead. No issue date? It estimates the lifetime from the CA/B Forum schedule.
• Auto-renewal that isn't renewing: if a certificate marked as auto-renewed enters its warning window, it gets flagged — the renewal job is probably failing.
• Domains with registrar and expiry, linked to the certificates that hang from them.
• Reminders without a server: an .ics file with one event per reminder for Outlook or Google Calendar.
• PDF report, CSV, JSON backup, undo/redo, command palette, English and Spanish.

Parsing X.509 in the browser, without a library

The page ships with a connect-src 'none' Content-Security-Policy, so no CDN and nothing leaves the machine. The certificate is read by a small DER/ASN.1 reader inside the HTML: walk the TLV structure, pull the validity UTCTime/GeneralizedTime, the subject and issuer CN, the SAN extension and the public key OID (RSA size or EC curve). The fingerprint comes from crypto.subtle.digest("SHA-256"). If the pasted text also contains a PRIVATE KEY block, it's ignored and the user is warned.

What it doesn't do

It doesn't scan your network or connect to your servers — the HTML can't reach the internet by design. It doesn't renew anything either: certbot and friends already do that. CertScope tells you what needs renewing, where it's installed and who owns it.

Try it (opens with sample data): https://marcosblg.github.io/certscope/
Code (AGPL-3.0): https://github.com/marcosblg/certscope

How do you keep track of the certificates automation doesn't cover?