How AlertWard works

Everything you need to set up a workspace and trust its reminders.

Getting started

• Create a client for each company you look after. Every item belongs to exactly one client.
• Paste your hosts and domains under Bulk add: AlertWard adds the TLS certificate of each host and the registration of each domain, then checks them within a minute.
• Add licenses, subscriptions and certificate files with their renewal dates, and set an owner for anything that matters.
• Invite your team. Reminders go to the item's owner, or to every owner, admin and member who has e-mail alerts on.

Item types

• SSL/TLS certificate — a host and port. We read the certificate actually served and check it daily.
• Domain registration — the registered domain (example.co.uk, not www.example.co.uk). Expiry, registrar and nameservers come from the registry, checked daily. A few registries do not publish expiry dates; for those, type the date yourself.
• License or subscription — vendor, product, seats, cost and renewal date.
• Digital certificate — certificate files such as ICP-Brasil A1 (e-CNPJ, e-CPF), code-signing or client certificates.
• Custom — anything else with a date: insurance, contracts, warranties.

Statuses

• OK — expiry is further away than the workspace's “expiring soon” window (30 days by default).
• Expiring soon — inside that window.
• Expired — the date has passed.
• Error — the last checks failed (host unreachable twice in a row, domain not registered) or the certificate has a blocking problem: untrusted chain, wrong hostname, self-signed. Expired always wins over error.
• Pending — not checked yet.

Weak but working settings (an RSA key under 2048 bits, a SHA-1 signature, validity over 398 days, an expired intermediate still served) are listed as warnings on the item without changing its status.

Reminders

By default reminders go out 60, 30, 14, 7, 3 and 1 day before expiry and on the day itself. Change the days in workspace settings.

• Each reminder is sent once per expiry date. An item added late gets only the current reminder, not a burst of old ones.
• Acknowledge means “someone is on it”: earlier reminders stop, but the last-day and expiry-day reminders still go out.
• Snooze silences an item for 1 to 90 days.
• Mark renewed: for certificates and domains we check again at once and confirm when the new expiry date is visible. For other items, enter the new date. A renewal starts a fresh reminder series.
• Several items due for the same person arrive in one e-mail.
• Telegram: under Account → Telegram, press Connect Telegram and then Start in the chat with @AlertWardBot. Reminders then also arrive there, with buttons to acknowledge or snooze; send /status to see what expires soon and /stop to disconnect. Each member can switch Telegram off per workspace under Team.

Roles

• Owner — everything, including billing and promoting admins.
• Admin — everything except billing: settings, members, deleting clients.
• Member — adds and edits clients and items, acknowledges and renews.
• Read-only — sees, never changes. A read-only seat can be limited to one client, which is how you give a client access to their own items. Read-only seats do not count towards the team-member limit.

Bulk add

Paste hosts, URLs or domains separated by new lines, commas or semicolons. https://shop.example.com:8443/login becomes the certificate on shop.example.com:8443 and the domain example.com. Lines starting with # are ignored; anything already monitored is skipped and reported.

The scanner

Our checks identify themselves as AlertWardBot/0.1 (+https://alertward.com/docs#scanner) for HTTP requests and open one TLS connection per certificate per day — no more than a browser visiting the page. We only connect to public addresses: names that resolve to private, loopback or reserved ranges are refused, and the address we check is the one we connect to.

Security

• Each workspace is isolated by row-level security in the database, on top of the checks in the application.
• Passwords are hashed with argon2id. Two-factor authentication (TOTP) is available for every account.
• Secrets such as two-factor seeds are encrypted at rest. Certificate private keys and their passwords are never stored.
• Every change is recorded in the workspace's audit log.