It was Saturday. I distinctly remember. I was still knackered when I woke up. It shouldn't have surprised me, really. I had been pulling overtime all week. Again. As I usually do, I checked my side project apps before the kids were up. And what do you know?! One was unreachable. Turns out I had forgotten to enable the "automatically extend Let's Encrypt certificate" option for one of my apps and the certificate had silently expired.
That's the thing about certificates. They expire silently without any warning. Something just breaks. Preferably crucial and in production. And then you're in a frenzy trying to find out what went wrong.
I normally use calendars for this. But calendars have a habit of notifying you when you're out and about with your family. And when you mark that notification as read? Gone. For good.
I needed something better. Something that would send an email or a Slack message. Something that sticks. Not just a notification to my phone.
So I built CertWatch. And unlike what you might expect, this isn't a post about TLS or certificate expiry. Nope. This is a post about how "Pffft, I can do this in a month" turned into seven months of early morning hacking, while having a full-time job and handling family life, to get to "closed beta".
The beginning
The idea is simple enough that I believed it could be done easily and quickly. A user enters a URL, the app obtains the public key from the certificate and stores it. Then, when it expires or changes, the user gets notified by email. It was March. I was sure I could get it done by the end of June. Easy, peasy. As long as I didn't procrastinate.
There were a few constraints. Full-time job, family, and about an hour of spare time to actually make something. The app had to be in .NET 10 using Microsoft MVC. And since I'm hosting everything on shared hosting, I had to use an embedded database.
I decided to use AI, but not for coding. Instead, I used it as a personal fan club: tracking my progress, kicking my butt when I procrastinate, and telling me I was the best in the world in between (obviously). I also used AI to learn marketing, because I really, really suck at it. It worked. Most of the time.
The first month went on basics: idea validation, database model, and setting up the basic application. The easiest was the database model. I already knew what embedded database to pick (SQLite, d'oh). Idea validation took time and a lot of reading. I also managed to find a few users interested in my non-existent app. I created a very basic website and published it.
Unsurprisingly, setting up the basic app took most of the time. Version 1.0 was a single-user app that notified me when a certificate expired. I had to enter certificates manually and directly into the database. But at least I had a script I could use to create a version.
I also did light Twitter marketing that got about a hundred views in total and zero traction. LinkedIn was a tad better and got a few people on my wait list.
The work continues
Encouraged by the LinkedIn response, I spent April and May making sure CertWatch supports multiple users. I also created the option to enter and view APIs being monitored. Still no login, though. But at least the app displayed errors nicely.
In June, work and family life kicked in and time got sparse. In the first half of the month, I only managed some maintenance work on the part that handled expiration notifications and cleaned up the code. Thankfully, things changed and by the end of the month I finished the login page. It took database model changes and a lot of elbow grease. The app could log users in now. I had no way to add them except by inserting them into the database by hand.
And this was Version 1.01.
July was spent on vacation, family, and work. The app lay forgotten until August. It was time to focus on user security features. Since I was entering users by hand, the app desperately needed a password change option. I also had to redo the entire navigation, since navigation up to now had only been "Logout". And that was basically it for August and Version 1.02.
The only thing left was to give wait-listed users access and contact them. I assembled a nice email, sent it over and… none of them even tried to log in.
I spent zero time on marketing, which in hindsight was not the best idea. I did manage to convince a good friend to try it out for his own projects. So my app now had two users, including me.
First bugs and improvements
Encouraged by getting one other soul on board, I started September strong. I needed to fix bugs and two of them were nasty.
One was related to displaying an error when trying to log in with an invalid password. In production, the login error didn't show. Users got a 404 error instead. It ended up being a stupid redirect mistake, but it took time to find.
The other bug was related to storing certificate expiration dates in local time instead of UTC. A rookie mistake that took way too much time to fix. Version 1.10 was ready by mid-September.
After that, my focus shifted to improving UX. Until now, users had to enter URLs with "https://" in front. This was unnecessary, since you cannot check a certificate over http. So I removed that.
I also added sorting for entered URLs and a page showing certificate details including public key download. I am proud of that.
For once I at least pretended to do some marketing. For Version 1.11, released by the end of September, I added a screenshot of the app to the app's web page and did minor tweaks to the subtitle and call-to-action button. I pinged the LinkedIn wait-listed people again and was met by a wall of silence.
User registration
The app still had no self-registration. That's exactly what I've been working on in October. But since I don't want any odd spammer to gain access, I decided registration should require a promotion code. Which filled my to-do list. It is surprising how much time and energy a simple thing like a promotion code generator and consumer takes.
But come October 16th, Version 1.12 was released and users can finally register for themselves. Provided they somehow obtain a promotion code.
If you want to try it…
CertWatch is a quiet little tool for a quiet little problem: certificates that expire whether or not you remember to check.
If you run services—a side project, a company, anything with an HTTPS endpoint—I have a small number of closed-beta codes. Each one lets you set up an account, add your interfaces, and get notified before anything expires. Go to the link below and click the "Request access" button. No matter what the page says, you don't have to pay to be a beta user.
I wrote this post myself. I used AI to keep me motivated during the build and to learn marketing, but not to write it. If you try CertWatch and something breaks, tell me—that's the whole point of a beta.
Top comments (0)