SSL ChecksEndpoint ProbesProduct

See Which SSL Certificate Your Endpoint Serves

The only certificate that matters during an incident is the one your endpoint is serving. CertLocker probes make that visible.

Start hosted evaluation Discuss onsite evaluation

The problem this fixes

Inventory says renewed, endpoint still serves old certificate.
Chain errors break clients even when the leaf certificate is valid.
Wrong SNI or default route serves the wrong certificate.

The CertLocker workflow

1
Register endpoint.
2
Bind it to certificate inventory.
3
Probe hostname, SNI, chain, expiry, and fingerprint.
4
Alert owning group on mismatch.
5
Keep result as evidence.

Operational proof points

Expiry

94%

Catch certificates before they fail.

Chain

82%

Find incomplete or wrong chains.

Mismatch

89%

Detect stale served certificates.

Evidence

76%

Keep proof after renewal and reload.

Inventory is not enough

Inventory is planned state. Endpoint probes are observed state. You need both because production serves what the process has loaded, not what the spreadsheet says.

Useful after every renewal

Run probes after ACME renewal, certificate delivery, and reload. If the endpoint does not match the expected certificate, alert the owner with the exact mismatch.

Backlinked guides and feature pages

Certificate lifecycle management

Inventory, renewal, delivery, ownership, and audit for TLS certificates.

Certificate delivery tokens

Scoped certificate access for HAProxy, IIS, Nginx, scripts, and automation.

Endpoint probes

Check what production endpoints actually serve after renewal.

Verify the SSL cert your endpoint serves

The technical how-to behind live checks.