# certdesk

> Korean-language technical resource on TLS/SSL certificate operations, plus free web tools:
> certificate expiry & chain checker, CA industry news digest (ko/en/ja).

certdesk covers practical certificate operations: expiry checking, chain
troubleshooting, zero-downtime replacement (Nginx/Apache/IIS), certbot renewal
failures, wildcard vs SAN decisions, and domain-vs-certificate expiry risk.

## Tools
- [Certificate checker](https://certdesk.dev/check): verdict OK / WARN / CRITICAL / UNKNOWN from the certificate chain the server actually serves (measured from a Korean network) — verification (expired, hostname mismatch, untrusted root, missing intermediate), revocation via CRL, expiry thresholds (WARN 30 / CRITICAL 15 days by default, configurable), served chain, security grade (TLS versions, headers, redirect, key strength), issuer incident history. No signup. JSON API: https://certdesk.dev/api/v1/certificate?domain={domain} and https://certdesk.dev/api/v1/security?domain={domain}
- [CA industry news](https://certdesk.dev/en/news): daily digest of CA/Browser Forum posts and Mozilla CA Program incompliance cases, summarized in Korean/English/Japanese with source attribution.
- [Certificate-related CVE watch](https://certdesk.dev/en/cve): recent CVEs for OpenSSL/Nginx/Apache/Tomcat/IIS/certbot from NVD, updated daily, ko/en/ja summaries.
- [Remediation guides (Korean)](https://certdesk.dev/ko/guide/): step-by-step security fixes and certificate installation per web server (Nginx, Apache, Tomcat, IIS, WebtoB) with version branches and restart cautions.
- SSL badge: https://certdesk.dev/badge/{domain}.svg · Expiry calendar: https://certdesk.dev/calendar/{domain}.ics

## For agents and scripts (no signup, no API key)
- [MCP server](https://certdesk.dev/mcp) (Streamable HTTP): check_certificate, check_expiry (up to 5 domains), check_security, check_dns (nameservers, DNS provider, IP owner, CAA, SPF/DMARC, DNSSEC, registrar), check_dns_propagation (Korean ISPs + public resolvers + authoritative), explain_tls_error, watch_expiry (email alerts, double opt-in). Setup: https://certdesk.dev/en/api/
- [REST API v1](https://certdesk.dev/openapi.json) (OpenAPI 3.1): /api/v1/certificate?domain=, /api/v1/expiry?domains=a,b, /api/v1/security?domain=, /api/v1/dns-info?domain=, /api/v1/dns?name=&type=, /api/v1/explain?error=, POST /api/v1/watch. 30 requests/min per IP.
- [DNS propagation checker](https://certdesk.dev/dns/): compare TXT/CNAME/A across KT, SK Broadband, LG U+, Cloudflare, Google, Quad9, OpenDNS and the authoritative nameservers, measured from Korea.
- Verdicts come from the certificate the server actually serves: Korean measurement point A (full chain, CRL revocation) plus point B (KT, Seoul) and an overseas point (Tokyo) on the Globalping public measurement network (`measuredFrom`). If no point can read the certificate the status is UNKNOWN (never OK), `daysLeft` is null and CT logs appear only as `estimate`. `newer` = a renewed certificate exists in CT logs but is not deployed. CI gate: fail unless `status` is `OK`. Re-measure: `?fresh=1`. Status: https://certdesk.dev/status/
- Expiry thresholds: WARN within 30 days and CRITICAL within 15 days of expiry by default (shrunk to 1/3 and 1/6 of the lifetime for certificates shorter than 90 days); pass warnDays/critDays (1-365) to the API, badge, calendar, MCP tools or a monitoring subscription to change them. The applied values are returned in `thresholds`.
- Ports and mail servers: pass host:port — implicit TLS 443/8443/4443/9443/6443/636/465/993/995/853/5061/3269/8883 and STARTTLS 25/587 (SMTP), 143 (IMAP), 110 (POP3), 389 (LDAP). Every A/AAAA address (up to 5) is compared, so a node that missed a renewal shows up as NODE_MISMATCH / NODE_EXPIRING.
- Alerts: monitoring subscriptions (POST /api/v1/watch, MCP watch_expiry, /ko/subscribe) can add one alert channel URL (webhook): a Slack or Discord incoming webhook, a Telegram https://api.telegram.org/bot<TOKEN>/sendMessage?chat_id=<CHAT_ID> URL, or any public https endpoint that receives a JSON POST (version 1). Status changes and the weekly summary are posted there after email confirmation. slackWebhook is the older Slack-only alias.
- Paid certificates: monitored domains can carry the contract end date and DCV method ("shop.example.com 2027-05-01 email") — contract expiry is alerted separately from certificate expiry, and email DCV gets a reminder (email-based DCV ends 2028-03-15, CA/B Forum SC-090). DNS info parses CAA accounturi/validationmethods (RFC 8657; CA processing required from 2027-03-15).

## Certificate issuance guides (Korean)
- [무료 인증서 발급처 비교](https://certdesk.dev/ko/guide/ca-free-overview/): Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com, Actalis, cloud-managed; Buypass Go SSL discontinued (last issuance 2025-10-31)
- [Let's Encrypt 따라하기](https://certdesk.dev/ko/guide/ca-letsencrypt/) · [ZeroSSL](https://certdesk.dev/ko/guide/ca-zerossl/) · [Google Trust Services](https://certdesk.dev/ko/guide/ca-google-trust-services/) · [Cloudflare/AWS/Azure](https://certdesk.dev/ko/guide/ca-cloud-managed/)
- [유료 인증서 발급 따라하기](https://certdesk.dev/ko/guide/ca-paid/): DCV methods and 199-day reissue rules per CA (DigiCert, Sectigo, GlobalSign, Certum)
- [SSL 인증서 가격·프로모션 비교](https://certdesk.dev/ko/deals/): prices checked on seller pages, with check date

## Articles (Korean)
- [SSL 인증서 만료일 확인하는 방법](https://certdesk.dev/ko/blog/ssl-expiry-check/): browser/openssl/PowerShell, common pitfalls
- [크롬은 되는데 파이어폭스만 인증서 오류](https://certdesk.dev/ko/blog/cert-chain-errors-differ-by-browser/): trust stores, AIA fetching, SEC_ERROR_UNKNOWN_ISSUER
- [NET::ERR_CERT_AUTHORITY_INVALID 원인별 해결](https://certdesk.dev/ko/blog/err-cert-authority-invalid/): issuer-based diagnosis in 6 branches
- [Nginx 인증서 교체와 무중단 리로드](https://certdesk.dev/ko/blog/nginx-cert-replace-zero-downtime/)
- [certbot 자동갱신 실패 원인](https://certdesk.dev/ko/blog/certbot-renewal-failures/)
- [Apache·IIS 인증서 교체 절차](https://certdesk.dev/ko/blog/apache-iis-cert-replace/)
- [와일드카드 vs SAN](https://certdesk.dev/ko/blog/wildcard-vs-san/)
- [인증서 만료 사고는 왜 반복되는가](https://certdesk.dev/ko/blog/why-cert-expiry-incidents-repeat/)
- [도메인 만료 vs 인증서 만료](https://certdesk.dev/ko/blog/domain-expiry-vs-cert-expiry/)
- [고객사 도메인 50개 엑셀 없이 관리하기](https://certdesk.dev/ko/blog/managing-50-domains-without-excel/)
- [만료 알림 체계 직접 만들기](https://certdesk.dev/ko/blog/build-cert-expiry-alerts/)
- [NET::ERR_CERT_COMMON_NAME_INVALID 원인별 해결](https://certdesk.dev/ko/blog/err-cert-common-name-invalid/): SAN mismatch, wildcard depth, SNI/default certificate
- [PKIX path building failed 원인별 해결](https://certdesk.dev/ko/blog/pkix-path-building-failed/): Java truststore, missing intermediates, Tomcat/Spring
- [인증서 유효기간 47일 시대](https://certdesk.dev/ko/blog/cert-lifetime-47-days/): CA/B Forum SC-081 schedule (200 → 100 → 47 days)
- [Let's Encrypt OCSP 종료와 CRL 전환](https://certdesk.dev/ko/blog/lets-encrypt-ocsp-end/): leftover OCSP settings to clean up

## Optional
- [RSS — articles](https://certdesk.dev/rss.xml) · [CA news](https://certdesk.dev/en/news/rss.xml) · [CVEs](https://certdesk.dev/en/cve/rss.xml)
- [Sitemap](https://certdesk.dev/sitemap-index.xml)