SSL Certificates

Find out well before a certificate expires, and see exactly what your server presents: issuer, names covered, chain, protocol and cipher.

What the SSL check looks at

An SSL certificate monitor opens a TLS connection to your host on the port set under Certificate settings (443 by default), sending the hostname so the server picks the right certificate. It reads the certificate it is given, and the chain above it, then closes the connection. No HTTP request is made.

The check passes while the certificate has more days left than Alert before expiry (30 by default). It fails when:

• the certificate has expired, or has that many days or fewer left;
• SSL/TLS verification is on (the default) and the certificate isn't trusted — an incomplete or self-signed chain — or doesn't cover the hostname;
• the server presents no certificate;
• the connection can't be made — the name doesn't resolve, the port is closed, or the handshake fails;
• the handshake doesn't finish within the monitor's timeout (30 seconds unless changed).

Days left are counted in whole days, rounded down. Each selected region runs the check, and the results are combined as described in Core Concepts.

Create an SSL certificate monitor

1. 1
   Choose the type

   On the Monitors page, click New, open the type picker and choose SSL certificate monitor. It is listed under Security & certificates.

2. 2
   Enter the domain

   Fill in Domain name with the bare hostname the certificate is served for, such as example.com or api.example.com — no https:// and no path.

3. 3
   Set the threshold and port

   Under Advanced settings, Certificate settings has Alert before expiry — 7, 14, 30 or 60 days — and Port, for a certificate served somewhere other than 443 (for example 8443, or 993 for IMAPS). The form's SSL verification section has only the SSL/TLS verification toggle for this type; the expiry threshold is Alert before expiry.

4. 4
   Create it

   Pick who is alerted under How should we escalate incidents? and click Create monitor. Check frequency under Advanced settings defaults to 3 minutes; a certificate changes rarely, so a longer interval is fine.

Monitor each hostname separately. A certificate for example.com says nothing about www.example.com if a different server answers there.

When it goes down

Expand a failed row under Recent checks to read it; the incident words the cause in plain language. Once the monitor is down for an approaching expiry, it stays down — with its incident open — until the server presents a certificate with more days left than the threshold. Renewing and deploying the certificate closes the incident on the next check.

The monitor page

An SSL certificate monitor's page shows what the last check found:

• The days until expiry, with the expiry date.
• The certificate: Common name, Alt names (every hostname it covers), Issuer and Public key.
• The Chain as served — leaf, intermediates and root — and whether it is trusted. A chain missing its intermediate certificate is called out.
• The connection: Protocol, Cipher, Key exchange, OCSP stapling and the Resolved IP the check connected to.
• Recent checks, one row per check, with the region it came from.

Certificates on website monitors

A website monitor for an https:// URL also reads the certificate with each check. Its page shows the result in the Domain & SSL card, next to the domain's registration expiry. With SSL/TLS verification on, an invalid or expired certificate fails the website check. An approaching expiry doesn't: it sends a reminder once the certificate is within the website monitor's SSL expiration setting. To have a monitor go down ahead of expiry, add an SSL certificate monitor for the same hostname.

Troubleshooting

The monitor shows a different certificate than my browser

The check connects to whatever address the name resolves to for it. Compare Resolved IP on the monitor page with the address your browser reaches. A CDN or load balancer can serve a different certificate from each edge.

The check fails with a connection error

• Make sure Domain name holds only the hostname. A URL with https:// or a path is not a valid host.
• The check connects on the Port you set (443 by default). A firewall that only admits known addresses will block it.

I renewed the certificate but the monitor is still down

The check sees what the server presents, not what is on disk. Reload or restart the web server or load balancer so it serves the new certificate, then wait for the next check.