{
  "host": "www.google.com",
  "port": "443",
  "leaf": {
    "subject": "www.google.com",
    "issuer": "WE2 (Google Trust Services)",
    "sans": [
      "www.google.com"
    ],
    "not_before": "2026-09-28T18:41:21Z",
    "not_after": "2026-12-21T18:41:20Z",
    "days_left": 62,
    "serial": "9200763DC8315C871025A546F963C556",
    "signature_algorithm": "ECDSA-SHA256",
    "public_key": "ECDSA P-256",
    "sha256": "6F77F1313EE0FC7A737561907EA6CDC4EEBA44FB5E37485299173CC8F7EDEE92",
    "is_ca": false,
    "self_signed": false,
    "crl": [
      "http://c.pki.goog/we2/xuzt3PU9F_w.crl"
    ],
    "scts": 2
  },
  "ca": "Google Trust Services",
  "acme": true,
  "lifetime_days": 84,
  "age_days": 21,
  "days_left": 62,
  "client_auth_eku": false,
  "ari": {
    "start": "2026-11-21T13:38:07Z",
    "end": "2026-11-21T14:38:07Z",
    "explanation_url": "https://status.pki.goog/",
    "state": "ahead",
    "early": false
  },
  "edges": [
    {
      "addr": "142.251.150.119:443",
      "subject": "www.google.com",
      "issuer": "WE2 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-28T18:41:21Z",
      "not_after": "2026-12-21T18:41:20Z",
      "days_left": 62,
      "sha256": "6F77F1313EE0FC7A737561907EA6CDC4EEBA44FB5E37485299173CC8F7EDEE92",
      "primary": true
    },
    {
      "addr": "142.251.151.119:443",
      "subject": "www.google.com",
      "issuer": "WE2 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-28T18:41:21Z",
      "not_after": "2026-12-21T18:41:20Z",
      "days_left": 62,
      "sha256": "6F77F1313EE0FC7A737561907EA6CDC4EEBA44FB5E37485299173CC8F7EDEE92",
      "primary": true
    },
    {
      "addr": "142.251.154.119:443",
      "subject": "www.google.com",
      "issuer": "WE2 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-28T18:41:21Z",
      "not_after": "2026-12-21T18:41:20Z",
      "days_left": 62,
      "sha256": "6F77F1313EE0FC7A737561907EA6CDC4EEBA44FB5E37485299173CC8F7EDEE92",
      "primary": true
    },
    {
      "addr": "142.251.153.119:443",
      "subject": "www.google.com",
      "issuer": "WE2 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-28T18:41:21Z",
      "not_after": "2026-12-21T18:41:20Z",
      "days_left": 62,
      "sha256": "6F77F1313EE0FC7A737561907EA6CDC4EEBA44FB5E37485299173CC8F7EDEE92",
      "primary": true
    },
    {
      "addr": "142.251.156.119:443",
      "subject": "www.google.com",
      "issuer": "WE2 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-28T18:41:21Z",
      "not_after": "2026-12-21T18:41:20Z",
      "days_left": 62,
      "sha256": "6F77F1313EE0FC7A737561907EA6CDC4EEBA44FB5E37485299173CC8F7EDEE92",
      "primary": true
    },
    {
      "addr": "142.251.157.119:443",
      "subject": "www.google.com",
      "issuer": "WE2 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-28T18:41:21Z",
      "not_after": "2026-12-21T18:41:20Z",
      "days_left": 62,
      "sha256": "6F77F1313EE0FC7A737561907EA6CDC4EEBA44FB5E37485299173CC8F7EDEE92",
      "primary": true
    },
    {
      "addr": "142.251.155.119:443",
      "subject": "www.google.com",
      "issuer": "WE2 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-28T18:41:21Z",
      "not_after": "2026-12-21T18:41:20Z",
      "days_left": 62,
      "sha256": "6F77F1313EE0FC7A737561907EA6CDC4EEBA44FB5E37485299173CC8F7EDEE92",
      "primary": true
    },
    {
      "addr": "142.251.152.119:443",
      "subject": "www.google.com",
      "issuer": "WE2 (Google Trust Services)",
      "ca": "Google Trust Services",
      "not_before": "2026-09-28T18:41:21Z",
      "not_after": "2026-12-21T18:41:20Z",
      "days_left": 62,
      "sha256": "6F77F1313EE0FC7A737561907EA6CDC4EEBA44FB5E37485299173CC8F7EDEE92",
      "primary": true
    }
  ],
  "distinct": 1,
  "automation": "probably automated",
  "automation_evidence": "A 84-day certificate from Google Trust Services. Nobody renews certificates this short by hand for long, so a client is almost certainly doing it.",
  "ready": "ready",
  "summary": "Ready for 47-day certificates: renewal looks automated",
  "schedule": [
    {
      "label": "15 March 2026 (in force)",
      "max_days": 200,
      "dcv_reuse_days": 200,
      "renewals_per_year": 3,
      "status": "pass",
      "note": "Automated renewal absorbs it: about 3 renewals a year, none of them by hand.",
      "current": true
    },
    {
      "label": "15 March 2027",
      "max_days": 100,
      "dcv_reuse_days": 100,
      "renewals_per_year": 6,
      "status": "pass",
      "note": "Automated renewal absorbs it: about 6 renewals a year, none of them by hand.",
      "current": false
    },
    {
      "label": "15 March 2029",
      "max_days": 47,
      "dcv_reuse_days": 10,
      "renewals_per_year": 12,
      "status": "pass",
      "note": "Automated renewal absorbs it: about 12 renewals a year, none of them by hand.",
      "current": false
    }
  ],
  "findings": [
    {
      "status": "pass",
      "name": "Certificate lifetime",
      "value": "84 days",
      "note": "Already within the 100-day limit that applies from 15 March 2027."
    },
    {
      "status": "pass",
      "name": "Renewal automation",
      "value": "probably automated",
      "note": "A 84-day certificate from Google Trust Services. Nobody renews certificates this short by hand for long, so a client is almost certainly doing it."
    },
    {
      "status": "pass",
      "name": "Renewal timing",
      "value": "62 of 84 days left",
      "note": "No renewal is due yet."
    },
    {
      "status": "pass",
      "name": "ARI renewal window",
      "value": "2026-11-21 to 2026-11-21",
      "note": "Google Trust Services publishes when it wants this certificate renewed, and an ARI-aware ACME client follows it. That is how a CA gets millions of certificates replaced in hours when it has to revoke them."
    },
    {
      "status": "pass",
      "name": "Edges",
      "value": "8 addresses, one certificate",
      "note": "Every address the name resolves to serves the same certificate, so the last renewal reached all of them."
    }
  ],
  "reproduce": "for ip in $(dig +short www.google.com A www.google.com AAAA); do echo \"$ip $(echo | openssl s_client -connect \"[$ip]:443\" -servername www.google.com 2\u003e/dev/null | openssl x509 -noout -enddate)\"; done"
}