Skip to content
Go to dashboard

2.8TLS certificate

What it checks#

TLS is what puts the lock in https. A TLS certificate monitor connects to your host and reads its certificate. It checks that the certificate is trusted, matches the host name, is still valid and has not been revoked (cancelled early). It also counts the days left. It can watch public certificate logs for certificates from a certificate authority (CA) you did not expect. A CA is a company that issues certificates.

When it is up, degraded or down#

  • Up: the certificate checks out and more than warn_days days are left.
  • Degraded: the certificate checks out, but warn_days or fewer days are left: certificate expires in N day(s).
  • Down: one of these:
    • the certificate has expired, does not match the host, or is not trusted;
    • no certificate presented;
    • the server does not send its intermediate certificate (incomplete chain: …);
    • certificate revoked on YYYY-MM-DD;
    • a CA outside your expected list issued a certificate (unexpected certificate in CT logs: …);
    • the host could not be reached.

If the revocation or certificate log lookup gets no answer, the rest of the check still counts.

Configuration#

TLS certificate monitors have no timeout field.

Dashboard fieldDefaultLimits and notes
nameEmptyRequired. Up to 200 characters, on one line.
check interval60 secondsAt least 1 second. Your plan's minimum interval still applies: below it the form shows Your plan checks at most every N seconds.
locationsNone (runs from us-west)Choose from the regions shown. The check runs from each one you pick.
on failure — notifyNone (all team channels)Pick channels to limit who is alerted. Shown only when your team has channels.
endpoint (host)EmptyRequired. Host only, such as acme.io. A scheme, port or path gives Host only — no scheme, port or path. Up to 253 characters.
endpoint (port)443Required. 1 to 65535.
warn_days211 to 365. Degraded once this many days or fewer are left.
expected CAs — certificate transparency watchEmpty (off)Names separated by commas. Up to 10 names, each up to 100 characters.

When you set expected CAs, a certificate for the host or a subdomain issued in the last 7 days by any other CA takes the check down.

Assertions supported#

None. warn_days and the expected CAs are the only settings.

Example#

API request body (CreateCertMonitor)
json
{"name": "acme.io certificate", "host": "acme.io", "port": 443,
 "warnDays": 21, "expectedIssuers": ["Let's Encrypt"],
 "intervalSeconds": 3600}

Good to know#

  • Through the API, warnDays 0 or left out means 30 days, and port 0 means 443. The dashboard starts at 21 days.
  • The certificate log watch does not apply when the host is an IP address.
  • After the first check, the current certificate card shows the subject, issuer and remaining lifetime.
  • URL and API monitors on https already warn at 30, 14, 7, 3 and 1 days left. A TLS certificate monitor lets you choose warn_days, and adds the chain, revocation and certificate log checks.
  • Expiry warnings: obsrvly sends a warning to the monitor's alert channels when warn_days days are left. It warns again at 30, 14, 7, 3 and 1 days, counting only the marks below warn_days. For example, with warn_days 21 you get warnings at 21, 14, 7, 3 and 1 days.
  • A degraded certificate check does not count as a failure, so it does not trigger a down alert. The expiry warning is the alert you get.
  • A renewed certificate starts its warnings again from the top. While the monitor is muted, warnings are not sent.

Last updated