# Boring Utils > Boring Utils does the boring chores of running domains and websites, so you don’t have to: Expiry Watch checks the certificates, domain registrations, DNS and email settings and scheduled jobs behind your sites and emails only when something needs attention. Chart Link, a chart builder that exports SVG and PNG, is a free bonus. What Expiry Watch watches, by group. Certificates: An email as a certificate’s expiry gets close: 7, 3 and 1 day before for the certificates software renews, 30, 14, 7, 3 and 1 for the ones renewed by hand; “Renewal looks late”: an email when a certificate hasn’t renewed by the time its site usually renews, learned from that site’s own habit; A certificate that stops being valid: no longer trusted, or no longer matching the name; The server addresses behind a name, up to 4 IPv4 and 4 IPv6, the same ones each day, not just the first that answers; the valid certificate that expires soonest sets the alerts. A load balancer behind one address can still hide a bad server on a given day. The domain: When the registration runs out: an email at 30, 14, 7, 3 and 1 day, where the registry publishes the date. DNS and email: An SPF record that mail servers reject: over its 10-lookup limit, published twice, or with a part they can’t read (paid plans); DMARC reports sent to another domain that hasn’t agreed to take them, or to one that has lapsed, and two DMARC records where there should be one (paid plans). Scheduled jobs: A link for each job to call when it runs, checked every 5 minutes: an email when a run is late, and another when it’s back. Alerts are quiet by design: nothing while a site is healthy, one email per problem, however often it comes and goes, for a scheduled job, an email when its ping is late and another when it’s back, a daily digest for things that need no action today and alerts about a site’s health held while our own checker looks unreliable (expiry alerts still go out). A failed check is reported as a failure, never as an expiry. The free plan watches up to 10 domains, checked daily. Paid plans watch up to 1,000 domains and add certificates checked every hour, alerts for SPF that mail servers reject and DMARC reports that won’t be delivered, more people to alert and client groups with a monthly report for each. Plans: Plus ($15 a month, 50 domains), Agency ($49 a month, 250 domains), MSP ($99 a month, 1,000 domains); a year costs 10 months. Payments go through Paddle, the merchant of record. The one-off checks and Chart Link stay free for everyone. Chart Link turns CSV or JSON into a chart in the browser and exports SVG or PNG. AI assistants can run the same checks through a read-only MCP server at https://boringutils.com/api/mcp (Streamable HTTP, no account or API key; setup: https://boringutils.com/expiry-watch#mcp). Its two tools are check_certificate (the TLS certificate a domain serves on port 443 now) and check_domain_expiry (the registration expiry over RDAP, where the registry publishes one). Tool calls share the site checker’s limit of about 20 a minute per calling address; over it, callers should retry after 60 seconds. The server can’t start alerts, and the acceptable use policy allows it within those limits but not for bulk checks. Guides are written to be cited: each one states when it was last updated, the command output it shows comes from our own runs, and every date, standard and limit links to its primary source. The tools inform; they never guarantee. Contact: hello@boringutils.com. ## Utilities - [Chart Link: free chart maker for SVG and PNG](https://boringutils.com/chart-link): Paste CSV or JSON and get a clean chart as SVG or PNG, sized for email, Slack, slides or a README. Free, in your browser, with no account. - [Expiry Watch: SSL and domain expiry alerts](https://boringutils.com/expiry-watch): Quiet alerts for your certificates, domains, DNS and scheduled jobs: an email when one needs you, never on a healthy day. Free for up to 10 domains. ## Free tools - [Bar graph maker: free, grouped or horizontal](https://boringutils.com/tools/bar-graph-maker): Make a bar graph from typed or pasted data: one series or several side by side, stacked or horizontal. Download it as PNG or SVG. Free, no sign-up. - [Bulk SSL and domain expiry checker](https://boringutils.com/tools/bulk-ssl-checker): Check up to 10 domains at once: SSL certificate expiry and days left, issuer, problems on any server address, and domain registration expiry. Free. - [CAA record checker and lookup](https://boringutils.com/tools/caa-record-checker): Check a domain’s CAA records the way CAs do, up the name and through CNAMEs: which CAs may issue, and whether yours may renew. Free, no account. - [Certificate chain checker: SSL chain test](https://boringutils.com/tools/certificate-chain-checker): See every certificate a server sends, from the site certificate to the root. Finds missing intermediates, untrusted roots and expired links. Free. - [Chart to PNG and SVG for email, Slack, slides](https://boringutils.com/tools/chart-to-png): Make a chart and download it as PNG or SVG, sized for email (600 × 300), Slack, a README, slides or social posts. Free, sharp at 2x, in your browser. - [CSV to chart: free online CSV chart generator](https://boringutils.com/tools/csv-to-chart): Paste CSV and get a bar, line, area, pie or scatter chart as SVG or PNG. Free, runs in your browser, no sign-up. Handles European CSV and currencies. - [Domain expiration checker and RDAP lookup](https://boringutils.com/tools/domain-expiration-checker): Free domain expiry checker: when a registration expires, straight from its registry over RDAP, with its registrar, nameservers and any hold flagged. - [Histogram maker: free, with automatic bins](https://boringutils.com/tools/histogram-maker): Make a histogram from one column of numbers: see where values bunch, how far they spread and which ones stray. Set the bins, get PNG or SVG. Free. - [JSON to chart: turn JSON data into a chart](https://boringutils.com/tools/json-to-chart): Paste JSON from an API or a script and get a chart as SVG or PNG. Reads lists of objects, Chart.js data and more. Free, in your browser, no sign-up. - [Line graph maker: free, with multiple lines](https://boringutils.com/tools/line-graph-maker): Make a line graph with one line or several from typed or pasted data, with dates spaced to scale. Download it as PNG or SVG. Free, no sign-up. - [Pie chart maker: free, with percentages](https://boringutils.com/tools/pie-chart-maker): Type or paste labels and values for a pie or donut chart with percentages worked out. Download it as PNG or SVG. Free, in your browser, no sign-up. - [Scatter plot maker: free, with groups](https://boringutils.com/tools/scatter-plot-maker): Make a scatter plot from two columns of numbers: see if they move together, spot clusters and outliers, and download it as PNG or SVG. Free, no sign-up. - [SSL certificate checker: expiry and chain](https://boringutils.com/tools/ssl-certificate-checker): Check a site’s SSL/TLS certificate: expiry date and days left, issuer, chain trust, hostname match and TLS version. Free, no sign-up. ## Guides: Certificates - [47-day SSL certificates: timeline and prep](https://boringutils.com/guides/tls-certificate-lifetimes-47-days): Public TLS certificates last at most 200 days since March 2026, 100 from March 2027 and 47 from March 2029. The sourced schedule, and how to prepare. - [Let’s Encrypt expiry emails ended: what now](https://boringutils.com/guides/lets-encrypt-expiry-emails-ended): Let’s Encrypt stopped sending certificate expiry emails on June 4, 2025. Why it stopped, who is affected, and the alternatives, free and paid. - [Certbot renew failed: what the error means](https://boringutils.com/guides/certbot-renew-failed): The Type and Detail lines in Certbot’s output name the cause. What unauthorized, connection, dns, caa and rateLimited mean, with real output and the fix. - [ERR_CERT_COMMON_NAME_INVALID on your site](https://boringutils.com/guides/err-cert-common-name-invalid): The name in the address bar isn’t on the certificate your server sent. Firefox calls it SSL_ERROR_BAD_CERT_DOMAIN. Find which name is missing and why. - [ERR_CERT_DATE_INVALID: what it means](https://boringutils.com/guides/err-cert-date-invalid): The certificate is expired or not yet valid by the device’s clock. If everyone sees it, renew and reload; if one device does, its clock is wrong. - [Check SSL expiry: openssl, curl, browser](https://boringutils.com/guides/check-ssl-certificate-expiry): Check when a TLS certificate expires: in Chrome, Firefox and Safari, with openssl and curl, across many hosts in bash, and from Node.js or Python. - [Fix “unable to get local issuer certificate”](https://boringutils.com/guides/certificate-chain-errors): Fix “unable to get local issuer certificate” and other TLS chain errors: missing intermediates, untrusted roots, wrong hostnames and expired certificates. - [What is lencr.org, and is it malware?](https://boringutils.com/guides/what-is-lencr-org): No, lencr.org is Let’s Encrypt’s own domain, not malware. What hosts like yr1.i.lencr.org serve, why devices contact them, and what to allow. - [Site still shows the old SSL certificate](https://boringutils.com/guides/site-still-shows-old-certificate): Renewed, but visitors still get the old certificate? The server wasn’t reloaded, or another server, address or CDN serves it. Find which, and fix it. - [Let’s Encrypt 64-day certificates: what to do](https://boringutils.com/guides/lets-encrypt-64-day-certificates): From February 10, 2027, Let’s Encrypt issues 64-day certificates by default. Who must act, how to check certbot, acme.sh, Caddy and cron, and how to test. - [Is Certbot auto-renewal working?](https://boringutils.com/guides/certbot-auto-renewal-check): Check three things: the timer (certbot.timer, or snap.certbot.renew.timer), a dry run, and the journal of the last run. When and how often Certbot renews. - [Let’s Encrypt certificates for IP addresses](https://boringutils.com/guides/lets-encrypt-ip-address-certificates): Yes, since January 15, 2026: IPv4 and IPv6, with the shortlived profile only, valid 160 hours. Which Certbot, lego and acme.sh versions can get one. - [nginx “ssl_stapling” ignored, no OCSP URL](https://boringutils.com/guides/nginx-ssl-stapling-ignored): Harmless: your certificate has no OCSP address, so nginx has nothing to staple. Let’s Encrypt dropped them on May 7, 2025. Remove ssl_stapling to clear it. - [DNS-PERSIST-01: what it is, who supports it](https://boringutils.com/guides/dns-persist-01): A TXT record at _validation-persist. lets one CA account renew with no DNS changes. Google Trust Services supports it; Let’s Encrypt: staging. - [Send email to a Slack or Teams channel](https://boringutils.com/guides/email-to-slack-or-teams-channel): Slack and Teams can give a channel its own email address. Where to find it, who can send to it, what admins can switch off, and why mail doesn’t arrive. - [Let’s Encrypt YE1 and YR1 chain errors](https://boringutils.com/guides/lets-encrypt-generation-y-chain-errors): Let’s Encrypt now issues from YE and YR intermediates whose roots aren’t trusted yet. Why some clients fail, how to see what you serve, and the fix. - [TLS client auth EKU removal: what breaks](https://boringutils.com/guides/tls-client-auth-eku-removal): Let’s Encrypt dropped the client authentication EKU on February 11, 2026, and Chrome’s rules end it for all public CAs. What breaks, and what to use. - [Fix “CAA record prevents issuance”](https://boringutils.com/guides/caa-record-prevents-issuance): A CAA record on your domain or a parent doesn’t list your CA. How to find it, add 0 issue "letsencrypt.org", and tell a real block from a SERVFAIL. - [Let’s Encrypt YE1 and YR1 certificates](https://boringutils.com/guides/lets-encrypt-ye1-yr1-certificates): YE1, YE2, YR1, YR2 and the Root YE and YR certificates: what each one is, the official downloads, their SHA-256 fingerprints, and which ones you need. ## Guides: Domains - [What happens when a domain expires](https://boringutils.com/guides/what-happens-when-a-domain-expires): An expired .com gets a grace period at the registrar, 30 days of redemption with a restore fee, then 5 days pending delete. The timeline, day by day. - [Domain status codes: what each one means](https://boringutils.com/guides/domain-status-codes): clientTransferProhibited is a normal lock. clientHold, redemptionPeriod and pendingDelete mean act now. Every domain status, as WHOIS and RDAP show it. - [How long does a domain transfer take?](https://boringutils.com/guides/domain-transfer-time): Up to 5 days for a .com once requested: the old registrar has 5 days to answer, then the registry approves it. What to do first, and what stops it. - [Who is my domain registrar and DNS host?](https://boringutils.com/guides/find-domain-registrar-and-dns-host): The Registrar field of a WHOIS or RDAP lookup names your registrar. Your DNS host runs the nameservers listed beside it, and is often another company. - [How long do DNS changes take?](https://boringutils.com/guides/dns-change-time): A changed record is live once the old TTL runs out. New nameservers usually take up to 48 hours: .com serves them with a TTL of 172,800 seconds. - [RDAP vs WHOIS: how to look up a domain](https://boringutils.com/guides/rdap-vs-whois): RDAP replaced WHOIS for generic domains in January 2025. What it is, how to query it with curl, how to read a domain’s expiry date, and its gaps. - [Is this domain expiration email a scam?](https://boringutils.com/guides/domain-expiration-email-scam): Probably, if it isn’t from the registrar you pay. How to check the real expiry date, spot the four common fakes, and what to do if you clicked or paid. - [Email stopped after changing nameservers](https://boringutils.com/guides/email-stopped-after-nameserver-change): Your new nameservers don’t have your mail records. Recreate MX, SPF, DKIM and DMARC there, and check each nameserver with dig to see what it serves. - [Can you have multiple SPF records?](https://boringutils.com/guides/multiple-spf-records): No. Two TXT records that start with v=spf1 make SPF fail with a permerror. How to merge them into one, keep it within 10 lookups, and check the result. ## Guides: Charts - [Charts in email that actually render](https://boringutils.com/guides/charts-in-email): Why JavaScript charts never render in email, and how to send ones that do: PNGs sized for retina screens, dark mode, alt text, Gmail and Outlook quirks. - [Send charts to Slack: n8n, Zapier and Make](https://boringutils.com/guides/send-charts-to-slack): Post a chart to Slack from a script, n8n, Zapier or Make: image blocks, file uploads after files.upload, Slack’s chart block, and what an image URL needs. - [Chart.js to PNG: browser and server export](https://boringutils.com/guides/chartjs-to-png): Save a Chart.js chart as PNG: toBase64Image and toBlob, waiting for animations, high-DPI output, a white background, fonts, and rendering in Node. - [Charts in a GitHub README: images or Mermaid](https://boringutils.com/guides/charts-in-github-readme): Put a chart in a GitHub README or pull request: SVG and PNG images, Mermaid pie and XY charts, light and dark versions, and what GitHub strips out. - [Charts in PDFs: vector SVG or 300 DPI PNG](https://boringutils.com/guides/charts-in-pdfs): Get sharp charts into PDF reports: keep them vector with SVG, or size PNGs for print. The pixel maths, Chromium print settings, fonts and canvas pitfalls. ## Guides - [Guides: certificates, domains and charts](https://boringutils.com/guides): Tested, sourced guides on TLS certificate expiry, RDAP domain lookups, chain errors, and getting charts into email, Slack, READMEs and PDFs. ## Reports - [SSL certificate statistics 2026: 10,000 sites](https://boringutils.com/reports/ssl-certificate-statistics): Our own survey of the top 10,000 websites, October 2026: certificate lifetimes, issuers, Let’s Encrypt’s new intermediates, keys and chain errors. ## Studio - [Boring Utils: free SSL and domain expiry alerts](https://boringutils.com/): The chores of running domains and websites, done for you: we watch your certificates, domains, DNS and scheduled jobs and email you when one needs you. - [Pricing: 10 domains free, plans from $15](https://boringutils.com/pricing): Free for 10 domains, checked daily. Paid plans watch up to 1,000 domains, certificates checked hourly: Plus, Agency and MSP from $15 a month. - [About Boring Utils](https://boringutils.com/about): A small studio doing the dull chores of running websites: it watches your certificates, domains, DNS and scheduled jobs and emails you when one needs you. ## Legal - [Acceptable use policy](https://boringutils.com/acceptable-use): How not to use Boring Utils: no bulk checks or scraping of our API, no pinging others’ jobs, no pointing the checker at private networks, no abuse. - [Privacy policy](https://boringutils.com/privacy): What Boring Utils collects (an email address, the domains you watch, check results, notes you send), why, how long we keep it, and your rights. - [Refund policy](https://boringutils.com/refunds): Refunds on the Boring Utils paid plans: ask within 30 days of any payment and we refund it in full, no reason needed. How to ask, and how to cancel. - [Terms of service](https://boringutils.com/terms): Terms for using Boring Utils: free tools provided as-is, monitoring that informs but never guarantees, your responsibilities, and governing law. ## Optional - [Full text of every page](https://boringutils.com/llms-full.txt): the pages above with their full content as Markdown, in one file.