Certificate Card

Features

• Two cards: a full Certificate Card and a compact Certificate Mini Card
• Automatic discovery of every Certificate Expiry sensor; pick, rename or hide certificates if you prefer
• Certificates sorted by expiry, soonest first, each with its expiry date, the days left as a badge and a bar (full bar: 90 days, the lifetime of a Let's Encrypt certificate)
• Configurable thresholds: orange under 30 days, red under 7 days by default; expired and invalid certificates in red, with the error the integration reports (hostname mismatch…)
• Valid / expiring / expired counters, and an "only certificates needing attention" mode
• Header status: All valid, Expiring soon, Expired, Invalid or DNS issue, and the next expiry (Next expiry in 4 days)
• Optional DNS checks, in a section that folds and unfolds: DNS IP sensors (resolved or not, with the address) and Ping or other connectivity binary sensors (reachable or not)
• Click any row to open its Home Assistant history (more-info dialog)
• Detail button at the top right of the mini card: it switches to the full card and back; a click anywhere outside the card brings the compact view back
• The days left stay up to date: the card checks them every minute
• Visual editor in the dashboard UI for both cards (no YAML needed)
• Light and dark mode; English, French, German, Spanish, Serbian (Cyrillic and Latin), Italian, Dutch, European Portuguese, Polish, Romanian, Danish, Swedish, Bulgarian, Russian, Ukrainian, Hungarian, Slovak, Czech, Slovenian, Latvian and Greek
• Single file, no external dependency

Supported integrations

Any other timestamp sensor holding an expiry date (a domain expiry sensor, say) can be listed with entities, and so can a sensor holding a number of days left.

Prerequisites

Home Assistant 2024.8 or later, and the Certificate Expiry integration set up for each host to watch (Settings → Devices & services → Add integration → Certificate Expiry: host and port). The DNS checks need the DNS IP integration for each host name, or Ping sensors.

Configuration

Visual editor#

Edit a dashboard, click Add card and search for Certificate Card or Certificate Mini Card. Every Certificate Expiry sensor is listed by default; pick some of them, hide others, set the thresholds, choose the sections to display and the language. The preview updates live, and options left at their default are kept out of the generated YAML.

Minimal#

type: custom:certificate-card

type: custom:certificate-mini-card

Full options#

type: custom:certificate-card
title: Certificates
entities:
  - sensor.home_example_org_cert_expiry
  - entity: sensor.vpn_example_net_cert_expiry
    name: VPN
exclude:
  - sensor.old_example_com_cert_expiry
warning_days: 30
critical_days: 7
show_counts: true
show_date: true
only_problems: false
show_dns: true
dns_entities:
  - sensor.home_example_org_ipv4
  - binary_sensor.gateway
expand_dns: false
language: fr

type: custom:certificate-mini-card
max_items: 3
warning_days: 30
critical_days: 7
show_dns: true
zoom: true
language: fr

Options reference#

How it works

The cards read the Home Assistant entity registry: every sensor of the Certificate Expiry integration (platform cert_expiry) is a certificate, every sensor of DNS IP (platform dnsip) a DNS check. Entity ids can therefore be in any language or renamed without breaking the cards. A row is named after its device — a Certificate Expiry device carries the host name — unless you give it a name.

A certificate's state is its expiry date. The days left are counted from now and checked every minute:

The header shows the most urgent status: an expired certificate first, then an invalid one, one expiring soon, then a DNS check failing; a click on it opens that entity.

A DNS IP sensor holds the address the host name resolves to, and becomes unknown when it does not resolve: the card shows Not resolved in red. A binary sensor is Reachable when on, Unreachable when off.

Support

If you find this project useful, you can support its development:

Fixes

• Folding back on a tap elsewhere now works on iOS (Safari and the companion app): a tap on something that is not clickable sent no click to the page, so the unfolded DNS section and the detailed view of the mini card stayed open. The press and the release are caught instead; a press in the card released outside of it and a scroll do not fold anything.
• Leaving the card (another dashboard view, a conditional card hidden) brings it back in its default state: sections folded as configured, mini card compact.
• Tests: the clock pinned by the tests now reaches the card, so that the days left they expect no longer depend on the time of day they run.

Features

• Certificate Card (custom:certificate-card): every SSL/TLS certificate monitored by the Certificate Expiry integration, sorted by expiry, with its expiry date, the days left as a badge and a bar, coloured against configurable thresholds (warning_days, critical_days); invalid certificates show their error.
• Valid / expiring / expired counters, and an "only certificates needing attention" mode (only_problems).
• Optional DNS checks, in a section that folds and unfolds: DNS IP sensors (resolved or not, with the address) and connectivity binary sensors such as Ping (reachable or not).
• Certificate Mini Card (custom:certificate-mini-card): the certificates expiring next, counters and DNS checks in a compact view, with a detail button switching to the full card and back.
• Certificate Expiry and DNS IP sensors found automatically through the entity registry; entities, exclude and dns_entities to pick them by hand.
• Visual editor for both cards; light and dark themes; 22 languages, English in the bundle and every other language loaded on demand.