How Tidehawk works
Tidehawk watches two separate clocks for every domain you track: when the TLS certificate expires, and when the domain registration expires. Nothing is installed on your clients’ servers.
Certificate discovery
Section titled “Certificate discovery”You give Tidehawk a hostname. From that it runs two kinds of lookup.
An active TLS scan connects to the host and reads the certificate the server actually presents. This is the only source that sees a deployed certificate that never reached a public log, including self-signed ones. It connects on port 443 by default, or the port you added to the hostname.
Certificate transparency directories are queried for every certificate ever issued under the domain. Tidehawk tries Certspotter first, then Censys if your deployment has credentials for it, then crt.sh. The first one to answer wins, and a source that is failing is skipped until it recovers. The lookup covers the whole subdomain tree, so a certificate for mail.example.com is found from a query for example.com.
A certificate is attached to a client when any of its subject alternative names matches one of that client’s tracked domains: an exact match, a wildcard that covers it, or a subdomain of it.
Domain expiry
Section titled “Domain expiry”Separately, Tidehawk asks the registry when the domain registration itself expires. It queries RDAP, using the IANA bootstrap list to find the right registry server for the top-level domain, and falls back to WHOIS for top-level domains with no RDAP service. From the answer it stores the registrar, the registration date and the expiry date.
Tidehawk never renews anything. See domain expiry tracking.
How often things are re-checked
Section titled “How often things are re-checked”| Check | Cadence |
|---|---|
| Certificate scan of a tracked domain | At least every 6 hours |
| Registry expiry lookup | At most once a day |
A sweep runs every six hours and picks up the domains that have gone stale, least recently attempted first. You can also force a scan yourself with Re-scan on any client page.
Alert evaluation
Section titled “Alert evaluation”Alert rules are evaluated against what discovery found. A rule has a scope (certificates or domains), a threshold in days, the clients it covers, and its channels. When a certificate or registration crosses a rule’s threshold, Tidehawk creates an alert event and delivers it.
The day thresholds behind the coloured status pills in the interface are separate from your alert rules. Those are described in certificate status, and the rules themselves in how alerts work.
Where PSA tickets fit
Section titled “Where PSA tickets fit”An alert rule can raise a ticket in your PSA as well as, or instead of, sending email. Tidehawk supports HaloPSA, ConnectWise, Autotask, NinjaOne and Syncro.
Tickets are self-healing. When a renewed certificate is discovered it supersedes the old one, the open alerts on the old certificate are resolved automatically, and Tidehawk closes the tickets those alerts raised. The same happens for a domain: when a registry lookup shows the expiry date has moved forward, the alerts raised from the old date are resolved and their tickets closed.