Monitoring
SSL Monitoring
TLS handshake and certificate expiry checks against a hostname. Pro and above.
Overview
An SSL monitor (kind ssl) connects to a hostname (default port 443), inspects the presented certificate, and evaluates validity and days until expiry. Health contributors use observed handshake and expiry data only.
Configuration
hostname— public hostname (SSRF-safe).port— default443.warnDays— warn when the certificate expires within this many days (default30, max 365).
Results
Failed handshakes, invalid chains, and certificates inside the warn window contribute to project health and can open alerts. Continuous execution requires Trigger workers (overview).
Plans
Requires Pro+ (ssl_monitor). Free workspaces cannot create SSL monitors — the UI and server both enforce the gate.
Limitations
- Does not replace certificate management or ACME automation.
- Private or blocked hostnames are rejected before the probe runs.
- No check history until the scheduler (Trigger) has executed the rule.