Certificate checks
A certificate check reads the TLS certificate chain of a monitor's server and checks it for problems. Spectate alerts before the certificate or an intermediate certificate expires, so you can renew it in time. It also alerts when the chain is not valid.
Which monitors have certificate checks
Certificate checks work for every monitor that does a TLS handshake:
- HTTPS monitors.
- TCP monitors with TLS set to TLS.
- SMTP, IMAP and POP3 monitors with TLS or STARTTLS.
When you create one of these monitors in the dashboard, certificate checks are on. In the API, certificate_check_enabled is false by default.
Turn certificate checks on or off
- Open the monitor.
- Select the Settings tab.
- Under Alerting, turn Certificate problems on or off.
- In Warn before expiry, enter the number of days, 1 to 90.
- Select Save changes.
The default for Warn before expiry is 14 days. In the API, it is certificate_expiry_threshold_days.
How the check works
The Spectate checker reads the certificate during a normal check, at most one time every 15 minutes. For an HTTPS monitor, it opens a separate TLS connection to the host and port of the URL after the HTTP check.
The checker verifies the chain against its trust store and the host name of the target. It reports the whole chain: the certificate of the server, the intermediate certificates and the root.
Certificate states
| State | Meaning |
|---|---|
pending | Spectate has not read the certificate yet. |
valid | The chain is trusted, and no certificate in it expires within Warn before expiry. |
expires_soon | The chain is valid, but a certificate that the server sends expires within Warn before expiry. |
expired | The certificate has expired. |
invalid | The chain is not trusted. For example, it is self-signed, for another host name, or misses an intermediate certificate. |
For expires_soon, Spectate looks at every certificate that the server sends, not only the server's own certificate. An expired intermediate certificate breaks the chain in the same way. Spectate ignores root certificates from the trust store of the checker.
Alerts
| Alert | Severity | Fires when |
|---|---|---|
| "Certificate expires soon for NAME" | medium | The state is expires_soon because of the server's own certificate. |
| "Intermediate certificate CN expires soon for NAME" | medium | The state is expires_soon because of an intermediate certificate. |
| "Certificate expired for NAME" | critical | The state is expired. |
| "Certificate invalid for NAME" | critical | The state is invalid. |
| "Certificate issuer changed for NAME" | low | A new certificate comes from another certificate authority than the previous one. |
The description of an "expires soon" alert gives the days left and the expiry date, for example "Expires in 13 days, on 9 Nov 2026." Emails, Slack and Telegram messages show it. The title does not change from day to day.
A monitor has one certificate state alert at a time. While the state stays the same, the alert stays open. Spectate updates the days left in the description, but it does not fire a new alert or escalate again. If the state changes, for example from expires_soon to expired, Spectate resolves the old alert and fires a new one. The new alert goes through the escalation paths again. When the certificate is valid again, Spectate resolves the alert.
The issuer change alert is a heads-up. A renewal by another certificate authority can be a planned change, a mistake or a takeover. This alert does not resolve on its own. Resolve it on the alert page after you check the certificate.
Certificates and uptime
Certificate checks and uptime checks are separate. An HTTPS check also verifies the certificate. If the certificate is expired or not trusted, the uptime check fails, and the monitor goes down too.
To keep the uptime check up with a self-signed certificate, turn on Allow insecure requests (HTTPS) or Allow invalid certificates (TCP and mail). Certificate checks still report the problem.
See the certificate
Monitors that use TLS have a Certificate tab. It shows the Certificate chain from the latest certificate check. For each certificate, it shows the subject, the issuer, the dates and the host names. It also shows the key, the signature algorithm, the serial number and the SHA-256 fingerprint. The tab also shows the TLS version and cipher suite.
The Overview tab shows the certificate state. If certificate checks are off, the Certificate tab says Certificate checks are off.