Certificate Watcher by QuadroOctopus

Browsers warn only when they don't recognize a certificate at all - they say nothing when a site you visit every day suddenly starts using a different one. Certificate Watcher watches for exactly that.

The extension keeps a local database of the TLS certificates of the sites you visit (one entry per domain, e.g. example.com). When a site you already know suddenly serves a certificate with a different public key, it shows a full-screen alert (or a top banner - your choice) with a "was → became" table (SHA-256, issuer, SPKI pin, subject) and a reminder to double-check the domain.

What it shows

• Familiarity score (0–100). Grows with how long you have used a site, how often you visit it, and how long its accepted certificate has stayed unchanged. The toolbar badge shows the score and a color from gray (new site) through green to dark green (long-time site). Pages without HTTPS are marked red. The score reflects only your own visit history. It is not a security assessment: a high score does not mean the site is safe or legitimate.
• Certificate change detection. Certificates are compared by their SPKI pin (SHA-256 of the SubjectPublicKeyInfo). A routine renewal under the same key is a quiet update - no alert. A genuine key change triggers the alert with the before/after details.
• CA change note. A change of the issuing certificate authority is flagged separately in the alert.
• Your call. From the alert you can accept the new certificate, reset the counter, inspect the details, or freeze the current pin. Certificate changes are often legitimate (renewals, key rotation, CDN or hosting changes) - the alert is a prompt to double-check, not a verdict.

Features

• Full-screen alert (or banner) with before/after certificate details
• Popup: familiarity score with a plain-language explanation ("You've used this site for N days…"), certificate card, the last 10 certificate changes, visit history chart
• Certificate expiring-soon warning (less than 14 days)
• Settings: CA-change policy, DER storage, quiet domains, per-host mode, interface language, dark theme, etc.
• JSON export/import of the extension settings

What it does NOT do

• It does not verify that a site is legitimate, safe, or official.
• It does not detect phishing or malware, and it does not block or modify any traffic.
• It cannot catch a site that is new to you: its only signal is a certificate change compared to what you saw on that domain before.
• It does not contact any third parties: there is no telemetry, no servers, no external requests of any kind (the Public Suffix List is embedded in the install).

If the alert fires, check the address yourself: look for typos and lookalike domains (examp1e.com, mail-[domain].com), and compare the certificate details shown in the alert.

Privacy

Everything stays on your device - the certificate database, visit history, and settings live in local browser storage (IndexedDB + local storage). The only network activity is reading the TLS certificate of the page you are already visiting.

Why the permissions

• webRequest (plus webRequestBlocking on Firefox) - the only way to read the TLS certificate of visited pages; on Firefox a blocking listener is required so the connection can be resolved via webRequest.getSecurityInfo().
• all_urls host permission - the extension must be able to see the certificate of whatever site you visit.
• tabs / webNavigation - to know which page finished loading.
• storage / notifications - local settings and the expiring-certificate notification.
• Content script (top frame only) - renders the alert overlay on the page; it reads nothing and sends nothing.