Open source · self-hosted · Apache-2.0

Nothing in your organization should expire by surprise.

Lapse finds what expires — TLS certificates, domains, Entra ID secrets, SAML certificates — gives each one an owner, warns in time and only closes the alert once it sees the renewal.

Try the live demo Download 
$ lapse scan
Scanning 8 items…

 STATUS    ITEM                       DAYS  OWNER
 EXPIRED   intranet.acme.local:443      -2  it
 CRITICAL  api.acme.com:443              6  platform
 CRITICAL  ERP Sync · secret prod        6  ana
 WARNING   acme.pe                      27  finance
 RENEWED   acme.com:443                174  it  was: 2026-10-02

Alerts sent: 3 · already sent before: 1

Why now

Certificates are getting shorter. Outages are not.

Public TLS certificates are limited to 200 days since March 2026, 100 days from 2027 and 47 days by 2029. Every renewal is a chance for something to break — and the reminder often lands in the inbox of someone who left the company.

2018An expired certificate cut mobile data for millions of O2 customers.
2020Microsoft Teams went down because an authentication certificate expired.
2023Part of Starlink's ground network failed over an expired certificate.

How it works

Four steps, one loop

Discover

Scans hosts, domains, files and cloud tenants, and searches Certificate Transparency for certificates nobody registered.

Assign

Every item has an owner and a backup. Entra ID credentials go to the application's owner automatically.

Alert

At 30, 14, 7 and 1 days by email, webhook, Slack, Discord, Teams or Telegram. Never twice for the same thing.

Verify

An alert only closes when a scan sees the new expiry date — not when someone says "done".

What it watches

Everything with an expiry date

hosts

TLS certificates

Any host:port speaking TLS, plus STARTTLS for SMTP, IMAP, POP3 and PostgreSQL.

domains

Domain registrations

Expiration dates straight from the registry through RDAP.

entra

Entra ID secrets beta

Client secrets and certificates of every app registration, with a read-only permission.

saml

SAML certificates

Signing and encryption certificates from any identity provider's metadata.

files

Certificate files

.cer, .crt and .pem files, such as the certificate used for electronic invoicing.

manual

Everything else

Licenses, contracts and policies, with the same owners and alerts.

Security

It watches dates, not secrets

Lapse runs on your machine and keeps a local SQLite file with names, dates and fingerprints. There is no Lapse server, account or telemetry.

  • Private keys (.pfx, .p12, .key) are rejected and never stored.
  • Credentials are only accepted as ${env:…} or ${file:…} references and never appear in the output.
  • Entra ID only needs Application.Read.All; Graph returns expiry dates, never secret values.
  • Every outbound connection is documented. Lapse opens no ports.
  • A single native executable, two dependencies, an SBOM and checksums with every release.

Get started

Running in five minutes

# Download the executable for your system from Releases, then:
$ lapse init
$ lapse scan
$ lapse discover your-domain.com
$ lapse report
# Or with Docker
$ docker run --rm --read-only -v "$PWD:/data" \
    ghcr.io/henrycarrascomedina-maco/lapse scan

# Fail a pipeline if anything expires within 14 days
$ lapse check --min-days 14