Built for Hosting Providers & Sysadmins

Multi-Port TLS & Certificate Monitoring for Hosting Infrastructure

Verify certificates across web, mail, file transfer, directory, and control panel ports from outside your network. Catch daemon reload stalls, OCSP stapling drops, and incomplete CA chains before customer tickets spike.

Create Free Account (20 Endpoints) Run Multi-Port SSL Check
Agentless external TLS handshakes Same host monitored across multiple ports Full CA chain & OCSP stapling checks
ExpiryHawk endpoint configuration panel showing Host/Domain, Protocol dropdown, custom Port selector, and TLS cipher inspection
Per-endpoint protocol & port selection alongside external TLS 1.3 handshake, cipher suite quality, and key size verification.

Native Protocol Presets & Multi-Port Coverage

Websites rarely run on port 443 alone. Hosting nodes expose customer email, FTP, LDAP, and admin panels on separate TLS listeners—and daemon reloads often leave mail or panel ports serving yesterday’s expired certificate.

Protocol Preset Default Port Hosting Infrastructure Example
HTTPS 443 Shared web clusters, reverse proxies, customer storefronts, SNI vhosts
SMTP Implicit TLS (SMTPS) 465 Exim / Postfix authenticated submission endpoints
IMAPS 993 Dovecot / Courier encrypted client inbox retrieval
POP3S 995 Legacy mail client POP-over-TLS endpoints
FTPS 990 Pure-FTPd / vsftpd / ProFTPD implicit TLS file transfers
LDAPS 636 Directory auth and centralized customer identity servers
Custom TCP Ports 1–65535 cPanel (2083), WHM (2087), Plesk/DirectAdmin (8443, 2222), custom origin listeners
Technical note on TLS mode: ExpiryHawk connects via direct implicit TLS handshakes against each configured TCP port (not plaintext STARTTLS protocol upgrades such as ports 25, 143, or 587). You can register the same hostname across multiple implicit-TLS ports—for example mail.host.example:443, :465, and :993—independently. Read our guide on monitoring SMTP & IMAP certificates.
Certificate metadata detail showing DNS SAN list, full CA Chain Subjects, OCSP Stapled status, OCSP update timestamps, and Domain RDAP details
External Edge Inspection

Verify OCSP Stapling, Intermediate CA Chains & Daemon Reloads

Installing or issuing an AutoSSL / Let’s Encrypt certificate on disk doesn’t prove edge clients see it:

  • Daemon Reload Drift: Detect when Apache reloads after certificate renewal while Dovecot (:993) or Exim (:465) continues serving an old serial number.
  • Intermediate CA & Root Transitions: Track CA Chain Subjects and spot broken intermediate bundles during root transitions (intermediate cert guide).
  • OCSP Stapling Health: Inspect OCSP Stapled state and This / Next Update validity directly from public TLS handshakes.
  • Zero On-Server Agents: Works purely from an external network perspective across bare-metal nodes, load balancers, Cloudflare origins, and shared panels.

Why Hosting & Ops Teams Choose ExpiryHawk

Purpose-built external TLS, port, and RDAP verification without agent sprawl.

External Perspective

Monitor websites and mail services from an external perspective matching real customer TLS connections.

Any Port 1–65535

External SSL certificate monitoring for HTTPS, SMTPS, IMAPS, POP3S, FTPS, LDAPS, and control panels.

RDAP + WHOIS

Domain expiry monitoring for supported TLDs via IANA RDAP with authoritative WHOIS fallback.

Automated Alerts

Dispatch automated expiry alerts to Slack, Discord, HMAC webhooks, Telegram, Email, or Browser Push.

Frequently Asked Questions for Hosting Providers

Can I monitor HTTPS, SMTPS, and IMAPS on the same hostname simultaneously?

Yes. ExpiryHawk stores uniqueness by host and port together, allowing mail.host.example to be monitored concurrently on 443, 465, 993, 995, and panel ports.

Does ExpiryHawk use direct implicit TLS or STARTTLS on mail ports?

ExpiryHawk uses direct implicit TLS handshakes on each configured port (including SMTPS 465, IMAPS 993, POP3S 995, FTPS 990, and LDAPS 636). Plaintext STARTTLS upgrades are not used.

Can I monitor control panel ports like cPanel 2083, WHM 2087, or Plesk 8443?

Yes. Enter any custom TCP port from 1 to 65535 when creating an endpoint monitor to inspect control panels and alternate TLS gateways externally.

Why verify OCSP stapling and full CA chains externally across hosting nodes?

Even when on-box certificates renew, mail or proxy daemons can hold expired certs in memory, or OCSP stapling can stall. External checks confirm the exact certificate chain and OCSP staple presented to clients over the internet.

Explore Other Solutions

For Web Developers For Web Design Agencies For IT MSPs For Freelancers

Monitor your web, mail, and panel ports from the outside

Start with 20 free endpoints (scale up to 500 when ready) and automate multi-port TLS and chain audits.

Create Free Account Read Custom Port TLS Guide