SSL/TLS certificate monitoring

CertObserver can automatically discover hosts under your domains using Certificate Transparency logs, monitor the certificates they use, and alert you before they expire.

For alerts when new certificates are issued for your domains, see Certificate Transparency monitoring.

Automatic host discovery

All publicly trusted SSL/TLS server certificates are logged to public Certificate Transparency (CT) logs. CertObserver collects all certificates from those logs.

Add a monitor for a domain, and CertObserver finds all unexpired certificates logged for that domain and its subdomains. It uses those certificates to discover hosts and then monitors the certificates those hosts actually use.

As new hosts are discovered from new certificates in the logs, they’re automatically added to the monitoring. This can cover hosts set up by another team or a service provider that you might have otherwise missed.

You can also add hosts manually and exclude hosts you don’t want monitored.

Monitoring certificates in use

CertObserver periodically connects to each monitored host to check the certificates it uses. The check frequency adjusts automatically based on previous results, but each host is checked at least several times a day.

You can monitor multiple ports on each host. This works with HTTPS and anything else where the TLS handshake starts immediately after the TCP connection is established, such as implicit FTPS, SMTPS, IMAPS, and POP3S.

Expiration warnings and alerts about other certificate issues can be sent via email, Slack, or both.

Expiration warnings

CertObserver can warn you before a certificate in use expires. Warning thresholds are configurable and work across different certificate lifetimes.

A warning threshold has two settings: the percentage of the certificate’s validity period remaining and a maximum lead time. A warning starts only when both limits are met. You can configure multiple thresholds.

Example warning configuration
Configuration			Example alert timing Time before expiration
Severity	Remaining validity	Maximum lead time	90-day certificate	7-day certificate
Notice	25%	14 days	14 days	42 hours
Warning	15%	7 days	7 days	About 25 hours
Critical	5%	1 day	1 day	About 8 hours

Other certificate issues

CertObserver can also alert you about other certificate issues, such as hostname mismatches, incomplete certificate chains, and untrusted roots.

Why monitor certificates if they renew automatically?

Automatic renewal can fail. CertObserver checks the certificates your hosts actually use and alerts you if they approach expiration.

Why use CertObserver’s certificate monitoring alongside an uptime monitor?

Your uptime monitor may already send expiration warnings. CertObserver’s automatic host discovery can help cover hosts you might otherwise miss. For example, someone else might get a certificate for a new host without adding the host to your uptime monitor or telling you.