{
  "host": "kirkdiamond.com",
  "port": "443",
  "leaf": {
    "subject": "kirkdiamond.com",
    "issuer": "WE1 (Google Trust Services)",
    "sans": [
      "kirkdiamond.com",
      "*.kirkdiamond.com"
    ],
    "not_before": "2026-09-16T15:33:28Z",
    "not_after": "2026-12-15T16:30:50Z",
    "days_left": 56,
    "serial": "B9D5AF78F15051701322E5463DCC9DCA",
    "signature_algorithm": "ECDSA-SHA256",
    "public_key": "ECDSA P-256",
    "sha256": "0E0160977BDACACB070773690E47A92BB892E5DB66F7EB2B03456C8808A29940",
    "is_ca": false,
    "self_signed": false,
    "crl": [
      "http://c.pki.goog/we1/bjvG4KmPlOU.crl"
    ],
    "scts": 2
  },
  "ca": "Google Trust Services",
  "acme": true,
  "lifetime_days": 90,
  "age_days": 33,
  "days_left": 56,
  "client_auth_eku": false,
  "ari": {
    "start": "2026-11-13T23:03:35Z",
    "end": "2026-11-14T00:03:35Z",
    "explanation_url": "https://status.pki.goog/",
    "state": "ahead",
    "early": false
  },
  "edges": [
    {
      "addr": "104.21.2.69:443",
      "subject": "kirkdiamond.com",
      "issuer": "WE1 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-16T15:33:28Z",
      "not_after": "2026-12-15T16:30:50Z",
      "days_left": 56,
      "sha256": "0E0160977BDACACB070773690E47A92BB892E5DB66F7EB2B03456C8808A29940",
      "primary": true
    },
    {
      "addr": "172.67.128.220:443",
      "subject": "kirkdiamond.com",
      "issuer": "WE1 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-16T15:33:28Z",
      "not_after": "2026-12-15T16:30:50Z",
      "days_left": 56,
      "sha256": "0E0160977BDACACB070773690E47A92BB892E5DB66F7EB2B03456C8808A29940",
      "primary": true
    },
    {
      "addr": "[2606:4700:3030::ac43:80dc]:443",
      "days_left": 0,
      "error": "not checked: this server has no IPv6 route",
      "skipped": true,
      "primary": false
    },
    {
      "addr": "[2606:4700:3030::6815:245]:443",
      "days_left": 0,
      "error": "not checked: this server has no IPv6 route",
      "skipped": true,
      "primary": false
    }
  ],
  "distinct": 1,
  "automation": "probably automated",
  "automation_evidence": "A 90-day certificate from Google Trust Services. Nobody renews certificates this short by hand for long, so a client is almost certainly doing it.",
  "ready": "ready",
  "summary": "Ready for 47-day certificates: renewal looks automated",
  "schedule": [
    {
      "label": "15 March 2026 (in force)",
      "max_days": 200,
      "dcv_reuse_days": 200,
      "renewals_per_year": 3,
      "status": "pass",
      "note": "Automated renewal absorbs it: about 3 renewals a year, none of them by hand.",
      "current": true
    },
    {
      "label": "15 March 2027",
      "max_days": 100,
      "dcv_reuse_days": 100,
      "renewals_per_year": 6,
      "status": "pass",
      "note": "Automated renewal absorbs it: about 6 renewals a year, none of them by hand.",
      "current": false
    },
    {
      "label": "15 March 2029",
      "max_days": 47,
      "dcv_reuse_days": 10,
      "renewals_per_year": 12,
      "status": "pass",
      "note": "Automated renewal absorbs it: about 12 renewals a year, none of them by hand.",
      "current": false
    }
  ],
  "findings": [
    {
      "status": "pass",
      "name": "Certificate lifetime",
      "value": "90 days",
      "note": "Already within the 100-day limit that applies from 15 March 2027."
    },
    {
      "status": "pass",
      "name": "Renewal automation",
      "value": "probably automated",
      "note": "A 90-day certificate from Google Trust Services. Nobody renews certificates this short by hand for long, so a client is almost certainly doing it."
    },
    {
      "status": "pass",
      "name": "Renewal timing",
      "value": "56 of 90 days left",
      "note": "No renewal is due yet."
    },
    {
      "status": "pass",
      "name": "ARI renewal window",
      "value": "2026-11-13 to 2026-11-14",
      "note": "Google Trust Services publishes when it wants this certificate renewed, and an ARI-aware ACME client follows it. That is how a CA gets millions of certificates replaced in hours when it has to revoke them."
    },
    {
      "status": "pass",
      "name": "Edges",
      "value": "2 addresses, one certificate",
      "note": "Every address the name resolves to serves the same certificate, so the last renewal reached all of them."
    }
  ],
  "reproduce": "for ip in $(dig +short kirkdiamond.com A kirkdiamond.com AAAA); do echo \"$ip $(echo | openssl s_client -connect \"[$ip]:443\" -servername kirkdiamond.com 2\u003e/dev/null | openssl x509 -noout -enddate)\"; done"
}