README.md
Rama main · réplica de lectura del repositorio original.
# CertLight
**Self-hosted TLS & certificate monitoring — with the configuration audit most uptime tools skip.**
> **Formerly "CertWatch"** — renamed to CertLight in Aug 2026. Same product, same licence keys, same database format; only the name changed.
*Real run: a host with a 1024-bit SHA-1 certificate expiring in 11 days, on a server that still
accepts TLS 1.1. The certificate is rotated and the protocol floor raised — and on the next scan
all five findings resolve on their own. Nothing was acknowledged by hand.*
Certificates expire silently and take production down with them. CertLight watches yours from your own server, and goes beyond "days remaining":
- **Expiry countdown** with staged severity (30 / 14 / 7 / 1 days) across all your hosts
- **TLS configuration grading** — obsolete protocols, weak ciphers, weak keys, SHA-1 signatures
- **Chain diagnostics** — broken/incomplete chains, missing intermediates, hostname mismatch, unexpected self-signed certs
- **Legacy protocol probe** — detects servers that still *accept* TLS 1.0/1.1 even when your browser negotiates 1.3
- **Findings that tell you what to do** — every finding ships with its remediation, deduplicated across scans, auto-resolved when fixed
- **Notifications that don't spam** — a burst of findings becomes one digest, not two hundred messages
> *Uptime Kuma tells you your site is up. CertLight tells you its TLS is right.*
## Self-hosted by design
Runs as a single binary or container on your infrastructure. **Your host list and scan results never leave your network.** Outbound connections only, to the hosts you register. No telemetry, no phone-home — license validation is pure local cryptography.
**See the actual output** — [a real scan, run and exported](docs/samples/): five public TLS test hosts, registered and scanned for real, findings reported exactly as the API returned them.
## Quick start
```bash
# Docker — build the image from this repo first; there is no published certlight image
docker build -t certlight .
docker run -d -p 127.0.0.1:8422:8422 -v certlight-data:/data certlight
# Or the bare binary
./certlight
```
Open `http://127.0.0.1:8422`, add your first host, and see results in seconds.
## Editions
| | Free (this repo) | Pro | Team |
|---|---|---|---|
| Monitored hosts | 10 | 100 | Unlimited |
| Scan interval | 12h fixed | Custom + scan-now | Custom + scan-now |
| Notifications | Webhook | + Email, Slack, Telegram | + PagerDuty, MS Teams |
| SIEM export (Wazuh, Splunk HEC, syslog JSON/CEF, NDJSON file) | ✓ | ✓ | ✓ |
| History | 7 days | 1 year | Unlimited |
| Multi-user | — | — | ✅ |
| Support | Community | Email | Priority |
**Whop sells paid licences only.** Free: github.com/nizartuanku/certlight — this repository is the free edition, Apache-2.0, no time limit; nothing on Whop is free, so try it here first.
Pro ($19/mo) and Team ($49/mo) licenses, each with a 14-day free trial:
**https://whop.com/nizar-tuanku/certlight-tls-monitor?utm_source=github**
A license key activates instantly and validates **offline** — CertLight never needs to reach our servers. An expired key never bricks the product; it simply returns to free limits.
## Requirements
- Linux (Ubuntu 22.04+ recommended), amd64
- Network reachability to the hosts you want to monitor
## Working with the other Hexward tools
Every tool in the line can emit its findings as syslog, which is how they feed
each other:
```bash
certlight -syslog loglight.internal:5514 # udp by default
certlight -syslog loglight.internal:5514 -syslog-network tcp
```
One RFC 3164 frame per finding, severity mapped onto the syslog severity so
your collector's existing routing rules still work, and the source address
carried in `src=` when the finding has one.
Point it at [Loglight](https://github.com/nizartuanku/loglight) and its findings
land next to Loglight's own detections: a Decoy trip from an address Loglight
already saw port-scanning is raised as one critical incident with the timeline
attached, rather than two alerts you have to join up yourself. Any other syslog
collector works too — there is nothing Hexward-specific about the format.
Available on every tier, free included.
## Send findings to your SIEM (Wazuh, Splunk, Elastic)
Every finding CertLight opens or resolves can leave as one
[Hexward Finding Schema](https://github.com/nizartuanku/hexward-core/blob/main/SCHEMA.md)
event (`hexward.finding/1`), the same shape every Hexward tool emits. Write a
SIEM rule once and it covers the whole line. **Available in every edition,
Free included.**
```bash
# NDJSON file for a Wazuh agent, Splunk Universal Forwarder or Elastic Agent
certlight -export-file /var/log/hexward/certlight.ndjson
# Splunk HTTP Event Collector (token read from a file, never a flag)
certlight -hec-url https://splunk.example:8088 -hec-token-file /etc/hexward/hec.token
# Syslog as HFS JSON or CEF, RFC 5424 by default, over udp, tcp or tls
certlight -syslog wazuh.example:5514 -syslog-format json -syslog-network tcp
certlight -syslog siem.example:6514 -syslog-format cef -syslog-network tls -syslog-ca-file ca.pem
# Webhook with the same events, authenticated with a shared secret
certlight -webhook https://hooks.example/hexward -webhook-format v2 -webhook-secret-file secret.txt
```
Ready-made content: [hexward-wazuh](https://github.com/nizartuanku/hexward-wazuh)
(decoder and rules, tested on Wazuh 4.14.9) and
[TA-hexward](https://github.com/nizartuanku/TA-hexward) (Splunk add-on).
| Flag | Default | Meaning |
|---|---|---|
| `-export-file` | off | Append HFS NDJSON to this file |
| `-hec-url`, `-hec-token-file`, `-hec-index`, `-hec-ca-file` | off | Splunk HEC; sourcetype `hexward:finding` |
| `-syslog-format` | `kv` | `kv` (original key=value line), `json` (HFS) or `cef` |
| `-syslog-network` | `udp` | `udp`, `tcp`, or `tls` (json/cef only; certificates are always verified) |
| `-syslog-rfc` | `5424` | Header for json/cef: `5424` or `3164` |
| `-webhook-format` | `v1` | `v1` (original digest) or `v2` (HFS events) |
| `-webhook-secret-file` | off | Shared secret sent as `X-Hexward-Token` (v1 and v2) |
| `-export-evidence` | `redacted` | `redacted` drops secret-like evidence keys; `none` sends no evidence |
Live export carries changes (`opened`, `resolved`). To load what already
exists, pull a snapshot once:
`curl -s http://127.0.0.1:8422/api/findings/export`.
## AI Assist (optional)
CertLight can explain a finding in plain language with a small language model that runs on
your own hardware. It is off by default. Turn it on by starting a
[hexward-ai](https://github.com/nizartuanku/hexward-ai) sidecar and pointing CertLight at it:
```sh
certlight -ai-assist-url http://127.0.0.1:8435
```
Each finding then gets an **✨ Explain** button. The model writes what the finding means and
what to verify before you act. It also gets a fixed disclaimer.
- **The engine still decides.** The model receives one finding after CertLight has produced it.
It cannot add, remove, re-score or close a finding. If the sidecar is off, slow or broken,
the button shows a short note and nothing else changes.
- **What leaves the process.** One finding: its check, title, target, severity, status,
remediation and a sanitised copy of its evidence. Keys that look like secrets (password,
token, secret, private, credential, cookie, session, signature and similar) are dropped
first. Nothing goes to the internet. The sidecar runs where you run it.
- **Editions.** The free edition works with a sidecar on the same host. That is the `lab`
profile, SmolLM3-3B. Pro and Team can also use one dedicated AI host for several products,
or your own OpenAI-compatible endpoint, through `-ai-assist-key-file`. The recommended
profile there is `smb` (Phi-4-mini-instruct). Enterprise uses Qwen3.5 (9B, or 35B-A3B as the benchmark tier) or your own endpoint.
- **Language.** English is the supported language in this release. `-ai-assist-lang id`
(Bahasa Indonesia) remains as an unsupported preview. More languages will be added based on
demand.
- **Honest limit.** Small local models sometimes add general background that is not in the
evidence. For example, they may name a well-known attack, and that background can be wrong.
Treat the explanation as a starting point. The finding, its evidence and its fix text remain
the record, which is why every explanation carries the "verify against raw findings" line.
- **Speed.** On a CPU-only machine an explanation takes about 15–50 seconds, depending on the
model. Measurements are in hexward-ai's `docs/TIERS.md`.
Environment equivalents: `CERTLIGHT_AI_ASSIST_URL`, `CERTLIGHT_AI_ASSIST_KEY_FILE`,
`CERTLIGHT_AI_ASSIST_LANG`, `CERTLIGHT_AI_ASSIST_NO_THINKING=1`.
## Honest limits
- CertLight is not a full uptime monitor — it watches TLS, not response times or page content.
- It does not renew certificates; it tells you before you need to.
- It cannot monitor hosts unreachable from where it runs — for internal hosts, run it inside that network.
- Grading reflects good practice; it is not a compliance certification.
## Built by
Nizar Tuanku — Cybersecurity Tools + AI. Part of the Hexward line of self-hosted security tools.
Cisco Secure Firewall operations? See [Firewall Operations Platform](https://whop.com/nizar-tuanku/firewall-ops-platform?utm_source=github).