Cert Lifetime Lint — TLS validity caps 200/100/47

It reads the certificate settings written in your repository - cert-manager duration and renewBefore, Terraform validity_period_hours, cfssl and step-ca expiry, openssl -days, keytool -validity, Ansible not_after, Traefik certificatesDuration and renewal cron schedules - and marks every value that a public certificate authority will no longer issue, with the replacement line beside it.

Platform, SRE and DevOps engineers who own the renewal path: the person whose pager fires when an ACME order is refused or a certificate expires at 3am. If you maintain cert-manager Certificates, Terraform tls resources, a cfssl or step-ca profile, or the crontab that runs certbot, this reads your files.

Free checkers connect to a live host and report the certificate that is already serving traffic. That certificate is valid, so they stay silent. The failure lives in the config you have not applied yet - a duration of 8760h that the CA will refuse at the next issuance. Nothing that probes a live port can see it.

Free covers one whole file: open a manifest, run the check, and all 16 rules report every over-cap line with its fix and severity. Nothing is watermarked, timed or locked after N runs. The licence changes the scope only - every file in the repository at once, a dated exported report, and JSON output for CI.

Hosted certificate-expiry monitoring runs about $25 to $29 a month, and it still only watches certificates that are already live. Auditing renewal config by hand means grepping every repository each time the cap steps down, which it does on 15 March 2027 and again on 15 March 2029. This is $29 once.