SSL monitors

An SSL monitor connects to your host over TLS and inspects the certificate it presents.

Settings

Setting	Default	Notes
URL	—	Must start with https://. The host name is used for the TLS connection and SNI.
Warning threshold	14 days	Between 1 and 90 days. The monitor fails when the certificate expires in fewer days than this.
Interval	Plan minimum	Any supported interval. Certificates change rarely, so 1 hour is usually enough.

When the monitor fails

Reason shown	Meaning
Certificate not trusted: <error>	The chain does not validate, e.g. self-signed, wrong host name, or missing intermediate certificate.
Certificate expired	The expiry date has passed.
Certificate expires in N days	Fewer days remain than your warning threshold.
No certificate presented	The server completed the connection without a certificate.
Connection error	The host could not be reached on port 443.

When the certificate is renewed, the next check passes and the incident closes automatically with a recovery alert.

Recommended setup

• Use a threshold of 14 days for certificates that renew automatically (for example Let's Encrypt, which renews at 30 days remaining). An alert then means renewal has failed for over two weeks.
• Use 30 days or more for certificates you renew manually.
• Add one SSL monitor per host name. A certificate on example.com does not tell you about api.example.com if they are served separately.

Free one-off check

To inspect a certificate without creating a monitor, use the SSL checker.