SaQura CertWatch — Getting started (Windows)

1. Unpack this folder anywhere you like (keep the folder complete).
2. Double-click "SaQura CertWatch" (the Q icon) — monitoring starts in the
   background and the interface opens in your browser. On the very first start
   you set your password there.
   If Windows SmartScreen warns you: "More info" → "Run anyway".
   The live log is written to data\certwatch.log.

3. Make the Q visible (once, recommended): Windows 11 hides new icons at first.
   You will find the Q behind the arrow (^) in the taskbar, to the left of
   language, Wi-Fi and clock. To keep it on the taskbar permanently: right-click
   the taskbar → "Taskbar settings" → section "Other system tray icons" → turn
   on the switch for "SaQura CertWatch".

As long as the Q is there, monitoring is running. Right-click it:
  Open dashboard    — the interface in your browser (same as a double-click)
  Open log file     — data\certwatch.log
  Stop monitoring … — asks first; only then do the checks end.

Then add a domain (e.g. your-domain.com) — CertWatch checks it immediately,
suggests further certificates it discovers for your domain, and keeps
checking daily from then on. Clicking an entry opens the detail view
(certificate chain, revocation status, reasoning behind the grade).

Set up mail delivery: gear icon (⚙) → enter mail server, sender and
recipients → "Send test email". Takes effect immediately, no restart — and
survives updates. Without mail delivery you still see everything in the
interface and in the data\outbox folder.

Around-the-clock operation (recommended for servers): monitoring belongs to
your Windows session, so logging out or restarting ends it. To detach it,
install it as a Windows service — from an ADMINISTRATOR command prompt, with
your own path:

  sc.exe create SaQuraCertWatch binPath= "\"C:\CertWatch\CertWatch.Server.exe\"" start= auto DisplayName= "SaQura CertWatch"
  sc.exe description SaQuraCertWatch "Watches certificates and reports expiry in time."
  sc.exe start SaQuraCertWatch

In service mode CertWatch keeps writing to data\certwatch.log. It holds the checks
with their grade, the alerts raised with their protocol number and any failures —
every line with date, time and time zone. The complete record of all events is kept
separately in the audit chain; you see it in the interface under "Activity". The Windows Event Log under the
source "SaQura CertWatch" carries only the milestones: service start and serious
failures. To see what the watcher did, use the file; the event log is meant for
monitoring the server itself.
The interface stays where it was, http://127.0.0.1:5210 — on this machine,
because CertWatch deliberately binds locally only. In service mode you do not
need the Q in the notification area; a double-click then just opens the
dashboard. To remove the service:
  sc.exe stop SaQuraCertWatch     and then     sc.exe delete SaQuraCertWatch

Updating to a new version: FIRST stop monitoring (right-click the Q → "Stop
monitoring …"; in service mode: sc.exe stop SaQuraCertWatch), then unpack the
new folder next to the old one, copy the data\ folder over from the old folder,
and only THEN delete the old folder. data\ holds your entire state — password,
check history, mail settings and the report chain. Note: while the old
monitoring is still running, double-clicking the new version shows the OLD
dashboard.

There are two ways to get a sealed report: the gear (⚙) → "Sealed report" →
"Create now", or automatically with the scheduled send. It is then stored in the
folder data/reports and attached to the report mail as a file.

Checking a report (works without CertWatch, too):
Every sealed report states a protocol number and a checksum over its content at
the top. Any auditor can recompute it: search the HTML file for data-seal — the
text between the two markers, hashed as UTF-8 with SHA-256, gives exactly that
checksum. The full check including the chain is done by the watcher, in the
folder of the installation the report came from:
   CertWatch.Server.exe --verify-report report.html
If it answers "Report unchanged. Content, protocol number and audit chain all
match.", the file is untouched. Reports you only view in the browser are
deliberately left unsealed.
Always check the FILE, not what the mail program shows: scheduled reports are
attached to the mail as a file, and the same file sits in the reports folder.
What a mail program displays is a rendering — it may rewrite HTML, and then the
checksum rightly no longer matches.

Changing the warning times (optional): with 30 days of validity left CertWatch
rates an address "Watch", with 14 "Medium", with 7 "High", with 1 "Critical". If
you obtain certificates by hand, you need the first warning earlier. The values live in
appsettings.json under CertWatch: WarnDaysWatch / WarnDaysMedium / WarnDaysHigh /
WarnDaysCritical (days); restart the watcher after changing them. The traffic light
in the overview follows the same value.

Forgot your password?  Right-click the Q in the notification area →
  "Reset password …". The starter asks first, briefly stops the watcher, resets
  access and starts it again; you then set a new password in the browser. Your
  data stays untouched and the action is recorded in the audit chain. For the
  service and the command prompt this still works:
  CertWatch.Server.exe --reset-password
  (asks first, then exits — start the watcher again afterwards; in scripts
  confirm with --yes).
  resets access; you then set a new password in the browser.
Unattended setup (scripts):  set CERTWATCH_PASSWORD=<min. 8 characters>
  before the first start applies the password without the browser dialog
  (set CERTWATCH_NO_BROWSER=1 suppresses the automatic browser opening).

On Windows every check is fully active — including TLS 1.3 and revocation
status (OCSP/CRL).

Digital signature: both "SaQura CertWatch.exe" and CertWatch.Server.exe carry a
publicly trusted certificate issued to "KyotoTech LLC" through Microsoft's
signing service (issuer "Microsoft ID Verified CS EOC CA 04"). Windows therefore
names the publisher at startup instead of warning about an unknown one. To
verify: right-click the file → Properties → Digital Signatures.
We deliberately do not quote a fixed fingerprint: the service issues
short-lived certificates on purpose and renews them continuously. Every
signature carries a Microsoft timestamp and stays valid even once the
certificate it was made with has long expired.
For a file that is not yet widely distributed, SmartScreen may still ask once —
that depends on how well known the file is, not on the certificate.
IMPORTANT: do NOT install any certificate into the Trusted Root
Certification Authorities — CertWatch never requires that. Administrators of
managed systems (WDAC/AppLocker) can export the signing certificate directly
from the EXE's signature and allow it with a targeted rule.

Running without the interface (administrators): CertWatch.Server.exe also runs
in the foreground from a command prompt; stop it with Ctrl+C.


Licence terms, third-party components and privacy
--------------------------------------------------
Three files are included with this package:
  LICENSE.txt ................ End User Licence Agreement (EULA) — what you may
                               do with CertWatch. The German version is binding;
                               English and Japanese versions are included.
  THIRD-PARTY-NOTICES.txt .... the third-party components inside the product
                               (.NET runtime, SQLite) and their licences.
  PRIVACY.txt ................ what CertWatch stores on your systems and which
                               outbound connections it makes.

Questions, problems, licence matters: support@kyototech.co.jp
