Security certificate expiry coverage calculator

Calculate endpoints with every required certificate date-current and endpoints with missing or noncurrent certificate records with your own figures.

Your numbers

Use the units shown. Results update as you change valid inputs.

Use endpoints with every required certificate date-current and endpoints with missing or noncurrent certificate records to compare changes to your inputs. The method and limits below explain the scope.

Examples

Examples

Try the starting example

Endpoints: ID, all required certificate IDs joined by |
Shop,CA|Leaf Docs,CA|Other Orphan,Missing
Certificate inventory: ID, valid-from date, expiry inclusive, supplied renewal lead calendar days
CA,2026-10-01,2026-12-31,30 Leaf,2026-10-01,2026-10-20,5 Other,2026-10-01,2026-11-30,10
Audit date
2026-10-20
Endpoints with every required certificate date-current (%)
66.666667
Endpoints with missing or noncurrent certificate records
Orphan
Certificate records at or past supplied renewal-initiation date
Leaf
Earliest required certificate expiry by endpoint
Shop: 2026-10-20; Docs: 2026-11-30; Orphan: Unknown: missing certificate
Required certificate IDs absent from inventory
Missing

Try another scenario

Endpoints: ID, all required certificate IDs joined by |
Shop,CA|Leaf Docs,CA|Other Orphan,Missing
Certificate inventory: ID, valid-from date, expiry inclusive, supplied renewal lead calendar days
CA,2026-10-01,2026-12-31,30 Leaf,2026-10-01,2026-10-20,5 Other,2026-10-01,2026-11-30,10
Audit date
2026-10-21
Endpoints with every required certificate date-current (%)
33.333333
Endpoints with missing or noncurrent certificate records
Shop, Orphan
Certificate records at or past supplied renewal-initiation date
Leaf
Earliest required certificate expiry by endpoint
Shop: 2026-10-20; Docs: 2026-11-30; Orphan: Unknown: missing certificate
Required certificate IDs absent from inventory
Missing
Calculation method

Calculation method

Endpoints with every required certificate date-current (%)

Require every explicit chain member to exist and valid-from≤audit≤expiry.

Endpoints with missing or noncurrent certificate records

List endpoints failing the complete supplied-chain date condition.

Certificate records at or past supplied renewal-initiation date

Compare expiry−lead days to audit, including expired records.

Earliest required certificate expiry by endpoint

Minimum known chain expiry, or Unknown if any required chain member is absent.

Required certificate IDs absent from inventory

Deduplicate missing referenced certificate IDs across endpoints.

Symbols and units
a
Endpoints: ID, all required certificate IDs joined by |
b
Certificate inventory: ID, valid-from date, expiry inclusive, supplied renewal lead calendar days
c
Audit date

Use the units shown. A list keeps the order in which you enter its values. The symbol ^ means “raised to the power of”.

Assumptions & limits

Assumptions & limits

  • A supplied multi-certificate-chain date audit, not a TLS handshake, trust-chain validation, revocation check, domain verification or automated certificate renewal.
Are these inputs private?

These calculations run in your browser. A shared link contains the values you choose to share. Only questions submitted to the separate AI finder are sent to OpenAI.

Further reading

NIST SP 800-53: background for inventory, access, audit and contingency controls; worksheet algorithms and rules are explicitly supplied, not NIST compliance tests ↗

Background reading; this does not imply endorsement or independent review of SumFizz.

Share this page
Share this calculator

Leave unchecked to share the page without your entered values.