kirkdiamond.com:443
Ready for 47-day certificates: renewal looks automated

certificate  kirkdiamond.com, issued by WE1 (Google Trust Services)
lifetime     90 days (2026-09-16 to 2026-12-15), 56 left
renewal      probably automated
ari window   2026-11-13T23:03:35Z to 2026-11-14T00:03:35Z (ahead)

PASS  15 March 2026 (in force)       max 200 days, ~ 3 renewals/yr  Automated renewal absorbs it: about 3 renewals a year, none of them by hand.
PASS  15 March 2027                  max 100 days, ~ 6 renewals/yr  Automated renewal absorbs it: about 6 renewals a year, none of them by hand.
PASS  15 March 2029                  max  47 days, ~12 renewals/yr  Automated renewal absorbs it: about 12 renewals a year, none of them by hand.

PASS  Certificate lifetime: 90 days
      Already within the 100-day limit that applies from 15 March 2027.
PASS  Renewal automation: probably automated
      A 90-day certificate from Google Trust Services. Nobody renews certificates this short by hand for long, so a client is almost certainly doing it.
PASS  Renewal timing: 56 of 90 days left
      No renewal is due yet.
PASS  ARI renewal window: 2026-11-13 to 2026-11-14
      Google Trust Services publishes when it wants this certificate renewed, and an ARI-aware ACME client follows it. That is how a CA gets millions of certificates replaced in hours when it has to revoke them.
PASS  Edges: 2 addresses, one certificate
      Every address the name resolves to serves the same certificate, so the last renewal reached all of them.

# every address for kirkdiamond.com
172.67.128.220:443                       2026-09-16 to 2026-12-15  Google Trust Services  0E0160977BDACACB  <- this report
104.21.2.69:443                          2026-09-16 to 2026-12-15  Google Trust Services  0E0160977BDACACB  <- this report
[2606:4700:3030::ac43:80dc]:443          not checked: this server has no IPv6 route
[2606:4700:3030::6815:245]:443           not checked: this server has no IPv6 route

reproduce: for ip in $(dig +short kirkdiamond.com A kirkdiamond.com AAAA); do echo "$ip $(echo | openssl s_client -connect "[$ip]:443" -servername kirkdiamond.com 2>/dev/null | openssl x509 -noout -enddate)"; done