Features

Everything below exists today. Where something is still coming, it says so.

Certificates

• Expiry, with warning. Checked daily on the free plan and hourly on paid ones, with alerts at thresholds you set rather than on the day itself.
• Change detection. A new issuer, a rotated key, names added or removed — recorded and alerted, so a certificate you did not order is something you hear about.
• Chain and hostname validation. A certificate that is valid but installed wrong is still an outage waiting for a browser to find it.
• Continuous Certificate Transparency monitoring. SSLup watches public CT logs directly for certificates issued to your domains, alerts you to unexpected issuance, and compares discoveries with what your servers actually present.
• Protocols beyond HTTPS. SMTP, IMAP and POP over TLS on their own ports, because mail certificates expire too and nobody is watching them.

Uptime

• HTTP and TCP checks as often as every five minutes, with response time recorded on every one.
• Keyword checks. A 200 that renders an error page is not up. Look for a string that only appears when the page really worked.
• Incidents with start, duration and cause, and availability over 24 hours, 7 days and 30 days.
• A public status page you can point customers at during an incident.

Email domain security

Run a free, on-demand check of the public controls that stop attackers impersonating your domain. No account or mailbox access is required, and the one-time result is not saved.

• DMARC enforcement, including monitoring-only and partial rollouts.
• SPF validation, including duplicate records, recursive DNS lookups, loops and unsafe policies.
• Conservative DKIM discovery. SSLup checks selectors associated with the detected mail provider and says when the result is inconclusive rather than claiming DKIM is absent.
• MTA-STS, TLS reporting and DNSSEC, with the live HTTPS policy validated when one is published.
• Safe remediation order that will not tell you to overwrite an SPF record before all legitimate senders are known.

Check a domain free

Alerting

• Email, Slack, Teams, Discord, Telegram, Pushover and webhooks — configured per group and per severity.
• Escalation and repeats until somebody acknowledges, so a 3am alert is not a single message nobody saw.
• Maintenance windows so planned work does not page anyone.
• A delivery record for every alert: which channel, which address, and whether it actually went.

For people managing more than their own domains

• Groups per client, each with their own contacts, escalation and status page.
• Scoped access so a technician sees the three clients they handle, not all forty.
• An activity log covering certificate changes, alerts, sign-ins and administrative actions.

AI analysis

On paid plans, SSLup can send a group’s certificate picture — endpoints, expiry dates, issuers, and the certificates the public logs show that were never installed — to a language model, and give you back a written assessment. It is a second read on a fleet, not a replacement for the alerts.

• What to do first. A ranked list rather than a sorted one: a production mail server ahead of a staging box with the same days remaining.
• A summary and the anomalies. What the fleet looks like overall, and anything that does not add up — a certificate logged but never served, an issuer nobody remembers choosing.
• On demand, or emailed. Press the button, or set a schedule: weekly on a day you pick, or monthly on a date, at an hour in your own timezone. It goes to the contacts on that group who asked for the report, and to nobody else.
• Nothing is sent until you ask. Not on sign-up, not in the background — only when you press the button or a schedule you turned on fires. The tab tells you what leaves the server before the first run.
• The numbers are ours, the words are the model’s. Days remaining, counts and statuses are rendered from the database. Models restate numbers wrongly, and this is a page people make renewal decisions from.
• Certificate fields are treated as untrusted. Anyone can obtain a certificate whose subject reads like an instruction, so the data is fenced and labelled, and the analysis drives nothing automatically.

How many analyses a month each plan includes is on the pricing page. The free plan does not include it.

Being built

Billing and self-serve subscriptions are not switched on yet, which is why there is no checkout on the pricing page. Referral credits are recorded now so they count once billing exists.