Open-source monitoring agent for internal SSL/TLS certificates, Active Directory Certificate Services (AD CS), and .local/internal domains - reporting into Expirity.
Status: Planning. This project isn't built yet. This repository exists to document the design, gather feedback, and let interested teams follow progress. If you land here, everything below describes what's planned, not what's shipped.
Cloud-based monitoring tools - Expirity included - check certificates and DNS records the way a browser would: from the public internet, against a public hostname. That works well for the vast majority of domains agencies and MSPs manage.
It doesn't work for certificates that only exist inside a private network:
- SSL/TLS certificates on internal web apps, intranets, and admin panels never exposed publicly
- LDAPS certificates on Active Directory domain controllers (port 636)
- Certificates issued by an internal Active Directory Certificate Authority (AD CS) for
.localor other internal-only domain suffixes - Internal services behind a VPN or segmented network with no public DNS record at all
A cloud scanner simply cannot reach any of this - there's no route in, and often no public hostname to resolve. Yet an expired internal cert is exactly the kind of "silent" outage this category of tool exists to prevent: LDAPS failures can lock out authentication, and internal AD CS-issued certs quietly expiring is a well-known cause of unplanned enterprise downtime.
Expirity Agent is a small, open-source binary you run inside your own network - on a server, a domain controller, or any machine with visibility into the certificates you want tracked. It periodically checks the certs and DNS state it's configured to watch, then reports the results outward to your Expirity account over HTTPS, authenticated with a scoped API key.
Nothing has to reach into your network. The agent only makes outbound calls.
Internal network Expirity.io
┌──────────────────────┐ ┌────────────────────┐
│ Expirity Agent │ outbound HTTPS │ Ingest API │
│ (your servers/DCs) │ ───────────────► │ (scoped API key) │
└──────────────────────┘ └────────────────────┘
│
▼
Same dashboard, same
alerts (Slack, Discord,
WhatsApp, email) you
already use for your
public domain portfolio
Planned checks:
- Internal SSL/TLS certificate expiry, issuer, and key details
- LDAPS certificate presence and expiry on domain controllers
- Internal DNS record monitoring against your own resolver
Running any binary with network reach inside a production environment - especially one that talks to a third-party SaaS - requires being able to read exactly what it does. That's not a nice-to-have here, it's the baseline requirement for anyone to reasonably install it. The agent will be fully open source under the MIT license from day one; nothing about how it collects or transmits data will be closed.
To set expectations clearly: this is a monitoring agent, not a certificate lifecycle management (CLM) platform. It will not issue certificates, automate renewals, or enforce cryptographic policy. If you need full CLM - automated issuance/renewal via ACME/SCEP/EST, policy enforcement, multi-CA orchestration - tools like Keyfactor, Venafi, or your existing AD CS tooling solve a different (and larger) problem than this project is trying to solve.
Expirity is a domain expiry, DNS, and SSL certificate monitoring SaaS for agencies, MSPs, and developers managing domain portfolios. This agent is a planned extension for the internal-network blind spot described above - the dashboard, alerting (Slack/Discord/WhatsApp/email), and account are shared with your existing Expirity account.
- Product: expirity.io
- Documentation: expirity.io/docs
- API reference: expirity.io/api
This repository will be updated as design work continues. Watch the repo to be notified when there's something to look at.