Cert Lifetime Lint — TLS validity caps 200/100/47

Finds the renewal settings in your repo that outlive the public TLS cap: 200 days since 15 March 2026, 100 days from 15 March 2027, 47 days from 15 March 2029.

Install free

Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.

VS Code MarketplacenpmDocker Hub
ext install ReadyStack.cert-lifetime-lint
npx @readystack/cert-lifetime-lint <file>
docker run --rm -v "$PWD:/w" getreadystack/cert-lifetime-lint /w

Team? One key for every ReadyStack linter, 5 seats, $149 once

Get one email when this rule changes
We watch the regulation and vendor sources behind Cert Lifetime Lint - TLS validity caps 200/100/47 every day. When a rule changes, you get a single email with what changed and the updated check. No newsletter.

Get the full version $29

Scans every file in the repository instead of one, writes a dated CSV/JSON/HTML evidence report, and prints machine-readable output so CI fails the build before an over-cap certificate ships.

One payment, one licence key for this tool. The key is shown right after payment.

Hosted certificate-expiry monitoring is $25-29 a month.

Buy the full version — $29

Questions people ask

What does Cert Lifetime Lint actually do?

It reads the certificate settings written in your repository - cert-manager duration and renewBefore, Terraform validity_period_hours, cfssl and step-ca expiry, openssl -days, keytool -validity, Ansible not_after, Traefik certificatesDuration and renewal cron schedules - and marks every value that a public certificate authority will no longer issue, with the replacement line beside it.

Who is it for?

Platform, SRE and DevOps engineers who own the renewal path: the person whose pager fires when an ACME order is refused or a certificate expires at 3am. If you maintain cert-manager Certificates, Terraform tls resources, a cfssl or step-ca profile, or the crontab that runs certbot, this reads your files.

Why will a free SSL checker not do this?

Free checkers connect to a live host and report the certificate that is already serving traffic. That certificate is valid, so they stay silent. The failure lives in the config you have not applied yet - a duration of 8760h that the CA will refuse at the next issuance. Nothing that probes a live port can see it.

What is free and what needs a licence?

Free covers one whole file: open a manifest, run the check, and all 16 rules report every over-cap line with its fix and severity. Nothing is watermarked, timed or locked after N runs. The licence changes the scope only - every file in the repository at once, a dated exported report, and JSON output for CI.

What would this cost otherwise?

Hosted certificate-expiry monitoring runs about $25 to $29 a month, and it still only watches certificates that are already live. Auditing renewal config by hand means grepping every repository each time the cap steps down, which it does on 15 March 2027 and again on 15 March 2029. This is $29 once.

Ask about this tool

One question, answered by the person who built it. Your email only if you want the answer sent.

Embed this tool on your site (free)

Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.

 All embeddable tools

For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →

Same job, next tool

Free in the browser. The full version is a one-time licence.

Cert Lifetime Lint - 200/100/47-Day TLS Audit$29Config & DSL Lint + Snippets — 9 Sets$29DeviceTree Config Audit: 23 dtc-Style Rules, 50 Snippets$29GNU GLOBAL (gtags) Workspace Setup Kit$29GNU Global C/C++ .vscode Config Pack$29ATS Resume Template — 6 Fill-In Word Documents for US Job Applications (Manage$29
ENDEJAESPT

Find a tool