SSL certificate monitors

What it checks

An SSL monitor connects to a host and port, completes a TLS handshake, and reads the certificate the server presents: who it's issued to, who issued it, when it became valid and when it expires. Because it reads what the server actually sends, it catches a certificate that was renewed on disk but never loaded, or one that's out of date on a load balancer or mail server.

It's checked once a day - a certificate changes rarely, and a daily read catches every change in good time.

Adding one

Under Monitors, choose Add Monitor, then SSL, and enter:

• Host - the server's name. A URL is cut down to its host.
• Port - 443 by default. Use 465 or 993 for mail servers, 990 for FTPS, or whatever port the service listens on.
• Reminders - any of 30, 15, 7 and 1 day before expiry. A new monitor starts with 30, 7 and 1 day on.

To add several at once, choose Add several at once and paste one host per line.

What it reports

State	Meaning	Monitor
Valid	In date, issued for this host, and trusted	Up
Expiring	Fewer than 30 days left	Up
Expired	Past its expiry date	Down
Name mismatch	Issued for a different name than the host	Down
Chain errors	Self-signed, missing an intermediate, or not trusted	Down
Not available	The server presented no certificate	Down

A certificate that's down raises a Monitor Down alert on every contact attached to the monitor, whatever its type.

Whether a chain is trusted is judged by the certificate lists on Mon's checkers. Those follow the operating systems' updates, not any one browser's, so a root a browser has just stopped trusting may still look trusted for a while.

Reminders

Each reminder you switched on is sent once, when the certificate first has fewer days left than it - the 1-day reminder when fewer than 2 remain. Reminders go to the monitor's email and Slack contacts that have SSL Expiring switched on, and say the host, port, who the certificate is for and from, its expiry date and the days left.

When the certificate is renewed and has more than 30 days left again, the reminders reset, ready for the next one.

Mon's SSL monitors and HTTP monitors

An HTTP monitor with Monitor SSL on checks its site's certificate as part of every check. An SSL monitor is for certificates an HTTP monitor doesn't reach - mail servers, admin panels on other ports, services that don't serve web pages - or for watching a certificate on its own.