cyberaffinity

Free tool

Certificate & Secret Expiry Calendar

Expired certificates and secrets take down websites, logins and integrations without warning. List everything that can expire, give each one an owner and a backup, and get reminders early enough to renew it calmly.

🔒 Everything stays in this browser — nothing is uploaded, and certificates are read on your device. Back up to a file regularly: clearing your browser data deletes what's here.

🔒 Saved only in this browser.

Managing expiry dates as part of a security program? AffinityOne tracks your security program, findings, and remediation with owners and due dates. Get early access

How it works

  • List everything that can expire. Website certificates, single sign-on (SAML) signing certificates, app client secrets, API keys, SSH keys, service account passwords, VPN and firewall certificates. If it breaks something when it expires, it belongs here.
  • Renew by = expiry date − lead time. Each type starts with a sensible lead time (for example 30 days for website certificates, 45 for SSO certificates, 60 for code signing, which often needs extra identity checks). Change it to match how long renewal really takes you.
  • Name a backup owner. Renewals often fall on someone's vacation, or on the person who just left. Every item should have a second person who knows how to renew it.
  • Verify auto-renew. Automatic renewal fails quietly — a changed DNS record, an expired payment card, or a server that can't reach the certificate authority. If an auto-renewing item is inside its renewal window, check that it really renewed and update the expiry date.
  • Keep the runbook with the item. Note where it's installed and the steps (or a link) to renew it. After renewing, use Mark renewed to record the new date; the old one goes into the item's history.
  • Plan for shorter certificate lifetimes. The maximum lifetime of public TLS certificates is being reduced in stages over the next few years, so renewals will come around more often. Automate renewal where you can and keep this list current.
  • Import instead of typing. Paste or load certificate files (PEM, .crt, .cer) to read the names and dates in your browser, or import a spreadsheet with the CSV template. Never paste private keys — this tool removes them if you do.
  • Get reminders. The calendar file adds an event on each renew-by date with reminders 30, 14 and 7 days before expiry. It works with Outlook, Google Calendar and Apple Calendar; some calendar apps ignore imported reminders or keep only one.
  • Tracking subscriptions too? Use the free SaaS Renewal Radar for software renewals and cancellation notice deadlines.

Dates come from what you enter or import; check the real expiry in the system that issued each item. This tool helps you keep track — it isn't legal or compliance advice.