SSL Monitoring
TLS handshake and certificate expiry checks against a hostname. Pro and above.
Overview#
An SSL monitor (kind ssl) connects to a hostname (default port 443), inspects the presented certificate, and evaluates validity and days until expiry. Health contributors use observed handshake and expiry data only.
Configuration#
hostname— public hostname (SSRF-safe).port— default443.warnDays— warn when the certificate expires within this many days (default30, max 365).
Results#
Failed handshakes, invalid chains, and certificates inside the warn window contribute to project health and can open alerts. Continuous execution requires Trigger workers (overview).
Plans#
Free and Pro run a daily SSL check for the hostname of each active HTTP monitor — no separate monitor needed. Standalone SSL monitors (ssl_monitor) aren’t part of the Free or Pro package; existing Team and Enterprise contracts keep them.
Limitations
- Does not replace certificate management or ACME automation.
- Private or blocked hostnames are rejected before the probe runs.
- No check history until the scheduler (Trigger) has executed the rule.