SaQura CertWatch — Getting started (Linux)

Requirement: 64-bit Linux. This archive comes in two architectures:
SaQura-CertWatch-Linux.tar.gz (x86-64) and SaQura-CertWatch-Linux-arm64.tar.gz
(arm64, e.g. Graviton/Ampere/Raspberry Pi). To see which one you need, run
  uname -m   (x86_64 or aarch64).

1. Unpack this folder anywhere you like.
2. In a terminal:  ./CertWatch.Server
   — interface: http://127.0.0.1:5210 (on the very first start, open that
   address in your browser and set your password).

Different port (if 5210 is taken): change the "Urls" line in
appsettings.json (e.g. http://127.0.0.1:5211), then restart the watcher.

Then add a domain (e.g. your-domain.com) — CertWatch checks it immediately,
suggests further certificates it discovers for your domain, and keeps
checking daily from then on. Clicking an entry opens the detail view
(certificate chain, revocation status, reasoning behind the grade).

Set up mail delivery: gear icon (⚙) → enter mail server, sender and
recipients → "Send test email". Takes effect immediately, no restart — and
survives updates. Without mail delivery you still see everything in the
interface and in the data/outbox folder.

Running as a service (recommended): the included certwatch.service file is
a systemd template — adjust the paths, copy it to /etc/systemd/system/,
then:  sudo systemctl enable --now certwatch

Where the log lives: In service mode the watcher writes to journald — read it
with  journalctl -u certwatch  (every check with grade and reason, every
alert). In terminal mode the same output appears in the terminal window.

Updating to a new version: stop the watcher, unpack the new folder next to
the old one, then take your state over LITERALLY like this (first check
whether the new folder already contains a data/ — e.g. after a trial start —
and delete that one first, otherwise your state ends up as data/data and the
watcher starts empty):
   rm -rf NEW-FOLDER/data
   cp -a OLD-FOLDER/data NEW-FOLDER/
Only THEN delete the old folder. If the watcher runs as the service user
(User=certwatch), hand the new folder back to it:
   sudo chown -R certwatch:certwatch NEW-FOLDER data/ holds your entire state — password,
check history, mail settings and the report chain.

There are two ways to get a sealed report: the gear (⚙) → "Sealed report" →
"Create now", or automatically with the scheduled send. It is then stored in the
folder data/reports and attached to the report mail as a file.

Checking a report (works without CertWatch, too):
Every sealed report states a protocol number and a checksum over its content at
the top. Any auditor can recompute it: search the HTML file for data-seal — the
text between the two markers, hashed as UTF-8 with SHA-256, gives exactly that
checksum. The full check including the chain is done by the watcher, in the
folder of the installation the report came from:
   ./CertWatch.Server --verify-report report.html
If it answers "Report unchanged. Content, protocol number and audit chain all
match.", the file is untouched. Reports you only view in the browser are
deliberately left unsealed.
Always check the FILE, not what the mail program shows: scheduled reports are
attached to the mail as a file, and the same file sits in the reports folder.
What a mail program displays is a rendering — it may rewrite HTML, and then the
checksum rightly no longer matches.

Changing the warning times (optional): with 30 days of validity left CertWatch
rates an address "Watch", with 14 "Medium", with 7 "High", with 1 "Critical". If
you obtain certificates by hand, you need the first warning earlier. The values live in
appsettings.json under CertWatch: WarnDaysWatch / WarnDaysMedium / WarnDaysHigh /
WarnDaysCritical (days); restart the watcher after changing them. The traffic light
in the overview follows the same value.

Forgot your password?  ./CertWatch.Server --reset-password
  asks once, deletes access and then exits. Start the watcher again afterwards and
  set a new password in the browser. Your data stays unchanged. In scripts (no
  terminal) confirm with --yes.
Unattended setup (scripts):  CERTWATCH_PASSWORD=<min. 8 characters>
  before the first start applies the password without the browser dialog
  (CERTWATCH_NO_BROWSER=1 suppresses the automatic browser opening).

On Linux every check is fully active — including TLS 1.3 and revocation
status (OCSP/CRL). Linux is the recommended platform for continuous
operation.

To stop: Ctrl+C in the terminal (or systemctl stop certwatch).


Licence terms, third-party components and privacy
--------------------------------------------------
Three files are included with this package:
  LICENSE.txt ................ End User Licence Agreement (EULA) — what you may
                               do with CertWatch. The German version is binding;
                               English and Japanese versions are included.
  THIRD-PARTY-NOTICES.txt .... the third-party components inside the product
                               (.NET runtime, SQLite) and their licences.
  PRIVACY.txt ................ what CertWatch stores on your systems and which
                               outbound connections it makes.

Questions, problems, licence matters: support@kyototech.co.jp
