SSL certificate monitors
A TLS handshake to a host and port on every check. Chain, hostname and validity are verified, expiry alerts fire at your thresholds, and the certificate's details and renewals are kept.
An SSL monitor opens a TLS connection to a host and port and looks at the certificate it gets. It is for any TLS endpoint, not only websites: an API on a custom port, a mail or database front end on a port that isn't refused (see the refused ports).
Settings
| Field | Rules | Dashboard default |
|---|---|---|
| Host | A host name, at most 253 characters. | required |
| Port | 1 to 65535. | 443 |
| Server name (optional) | The SNI name to ask for, when it differs from the host. | the host |
| Warn before expiry (days) | Up to 5 thresholds of 1 to 365 days. Empty alerts only once the certificate has expired. | 30, 14, 7 |
New SSL monitors start at a 1 minute interval in the dashboard (the CLI defaults to 1 hour). A certificate rarely changes within an hour; pick what you need.
What a check verifies
Every run checks the chain, the hostname and the validity dates explicitly, so a broken certificate is still described instead of failing the handshake silently. Then the expiry is judged against your thresholds.
| Condition | Severity | Word | Incident |
|---|---|---|---|
ok | ok | Valid | |
cert_expiring | warning | Expiring | At once, and again at each threshold |
cert_expired | critical | Expired | At once |
cert_invalid, cert_hostname, cert_not_yet_valid | critical | Invalid | At once |
timeout, dns, connect, tls, blocked_destination | critical | Unreachable | After the confirmation streak |
internal | inconclusive | Unknown | Never |
Expiry and validity problems don't wait for a confirmation streak: the date is a fact. A host that can't be reached is treated like a down website and confirmed first.
Alerts: expiring for a threshold crossed, expired for an expired or
invalid certificate, down for an unreachable host, recovered when
the next check passes. SSL monitors have no uptime; the list shows
the days until expiry instead.
The monitor page
The hero shows the days left until the certificate expires, with your thresholds on a timeline and the alerts already sent for the current certificate. Certificate details below it shows the newest certificate seen: subject, issuer, subject alternative names, validity period, serial number, SHA-256 fingerprint, signature algorithm, the chain the server presented and how many certificates the verified chain has.
When a check sees a newer certificate than the newest seen so far (expiring later), a Certificate renewed event is recorded with both certificates and listed in the monitor's history under the status it happened in. The first certificate seen is no renewal, and an older certificate (a load balancer node behind on renewals) changes nothing. No alert is sent for a renewal.
Create one from the CLI
nrc monitor monitors create "API cert" --type ssl --host api.example.com --alert-days 30,7
nrc monitor monitors certificate get "API cert"Every flag is in the CLI reference.
HTTP monitors
Every setting of an HTTP monitor. Method, headers with secrets, body, accepted statuses, timeout and slow threshold, redirects, TLS verification, the keyword check, and the certificate and domain expiry watches.
Domain expiry monitors
The registration of a domain, looked up through DomainRadar at most hourly. Alerts before it expires, when it expires, and when it is not registered at all.