FullyQualified Nederlands GitHub

Certificates · DNS · NIS2

Every domain, fully qualified.

FullyQualified watches the TLS certificates and DNS records of all your domains, tells you the moment something expires or drifts, and turns the results into a NIS2 report.

View on GitHubRun it yourself

Open source (AGPL-3.0). It only reads: nothing is ever changed in your environment.

The FullyQualified dashboard: seven monitored assets with status badges, two certificates expiring within 30 days and one expired certificate.
  • Open source, AGPL-3.0
  • Read-only: never changes your systems
  • Self-hosted today, EU-hosted version planned
  • Passkey sign-in, roles and single sign-on

Check a domain now

See the TLS certificate and the email and security records of any public domain in a few seconds. No account, nothing stored.

How the free check works

Public domains on port 443 only. A few checks per hour.

Certificates are getting shorter. Your spreadsheet is not keeping up.

Browsers and certificate authorities are cutting the maximum lifetime of public certificates. What was a yearly chore becomes a monthly one, and a forgotten certificate or a changed DNS record is an outage or a security hole.

100 days

Maximum certificate lifetime from 2027, down from a year.

47 days

Maximum certificate lifetime from 2029. Manual renewal stops being realistic.

NIS2

Requires demonstrable control, also from companies that are suppliers in someone else's chain.

What it keeps an eye on

Add a domain or an endpoint and the checks start. Every value is stored as a baseline, so a change is noticed, recorded and alerted.

Certificates

  • Found through Certificate Transparency logs and TLS endpoint scans
  • Expiry, issuer and whether renewal looks manual or automated
  • Untrusted, expired and soon-to-expire certificates flagged

DNS

  • SPF, DKIM, DMARC, CAA, MX, NS and DNSSEC
  • Dangling CNAMEs that allow subdomain takeover
  • Any change to a record is a recorded event

Alerts

  • Slack, Telegram, a generic webhook (PagerDuty, Opsgenie) or email
  • Sent when a status changes or a record drifts
  • Dashboard and change history in English and Dutch

Diagnostic toolbox

  • Signed-in checks for TLS, mail TLS, SPF, DKIM, DMARC and DNS, also for hosts you do not monitor
  • Each check runs once and stores nothing

The report is the point

Auditors and customers do not want a dashboard; they want proof. FullyQualified turns the latest results into a NIS2 report as PDF and Excel: your certificate inventory, your DNS controls per domain, and what changed in the last 90 days.

A report is evidence for the technical part of NIS2, not a compliance certificate. NIS2 covers far more than certificates and DNS.

The certificate inventory: host, issuer, expiry date, days left, source and renewal type, with an expired certificate in red.

From zero to first report in minutes

The goal is value within ten minutes of starting.

  1. Add your domains

    Type a domain or host:port. Certificates are found by scanning. On request, the public CT logs list more hostnames for you to review.

  2. Read the results

    See what expires, what is untrusted and which DNS controls are missing.

  3. Hand over the report

    Download the NIS2 report as PDF or Excel, and let alerts catch what changes next.

Self-host it in one command

FullyQualified is one .NET container and a Postgres database. Everything in the repository is open source under the AGPL-3.0, including accounts with passkeys, roles and single sign-on through OpenID Connect.

Then open http://localhost:8080 and create the first account. Cloud connectors, starting with Azure, are on the roadmap.

git clone https://github.com/pimvd/fullyqualified
cd fullyqualified
docker compose up

Hosted plans are planned

Prefer not to run it yourself? A hosted version in the EU, on Scaleway, is planned. Plans are by number of domains. Prices are not set yet.

Planned

Free

5 assets

  • Certificate and DNS checks
  • History: 1 month
Planned

Starter

25 assets

  • Everything in Free, plus the NIS2 report
  • History: 12 months
Planned

Business

100 assets

  • Everything in Starter, plus cloud connectors and SSO
  • History: 24 months
Planned

Custom

by agreement

  • Limits agreed per customer

Self-hosting stays free with no domain limit.

Questions

Does FullyQualified change anything in my environment?

No. It only reads: public DNS queries, TLS handshakes with the endpoints you add, and Certificate Transparency logs. Changing things, such as automated renewal, is a possible later step and would be opt-in.

What does it check?

TLS certificates (expiry, issuer, trust) and DNS records: SPF, DKIM, DMARC, CAA, MX, NS, DNSSEC and dangling CNAMEs. It records every change against a baseline and alerts you through Slack, Telegram, a webhook or email.

Does the report make me NIS2 compliant?

No. It gives you evidence for the certificate and DNS part of your technical measures. NIS2 compliance is much broader and is your responsibility.

Where does my data live?

When you self-host, on your own server in your own Postgres database. The planned hosted version runs in the EU on Scaleway.

How do people sign in?

With passkeys, so there are no passwords to leak. Single sign-on through OpenID Connect is supported too, and there are three roles: viewer, member and admin. New people join through single-use invitations.

Is it free?

Self-hosting is free and open source under the AGPL-3.0. A paid hosted version is planned; prices are not set yet.

Know what expires before it does.

Star the project, try it on your own domains, or tell us what is missing.

View on GitHubReport an issue