Why is this service connecting to my server?

Someone asked TTLwatch whether the certificate renewals of a domain keep up with shorter certificate lifetimes. To answer, our server looked at the certificate your server sends. Nothing more.

What our server does

• It looks up the name in DNS (addresses, CAA and MX records) through our hosting provider's resolvers.
• It opens a TLS connection to port 443, reads the certificate chain your server sends during the handshake, and closes the connection. No HTTP request is made on that connection.
• For the domain itself, it asks for one file: /.well-known/security.txt (and /security.txt if that is missing), with the User-Agent TTLwatch/1 (+https://ttlwatch.com).

The names it connects to are the one that was typed, its www twin, and up to 20 names that appear in public Certificate Transparency logs for the domain. It never scans ports or address ranges, never tries to sign in, and never tests for vulnerabilities.

How often

A check of the same domain runs at most once an hour; within that hour everyone sees the same result. Each visitor can start a few checks an hour, and every check needs a proof-of-work in the browser, so the check cannot be used to hammer a server.

Where from

From one server at Hetzner in Germany. Connections never come from the visitor's browser.

Opting out

Write to support@ttlwatch.com with the hostname or domain. We add it to our exclusion list, which also covers its subdomains, and our server will not connect to it again. The check then says that the owner asked us not to connect.

The same address works for any question about our checks.