Certificate

The Certificate Check reads the certificate of a Website and API Monitor’s address, and tells you before it expires and when it stops being trusted.

Only an address that starts with https has a certificate. On any other, the Monitor’s Checks card says:

Not available: only an https address has a certificate to read.

How often we read it

We read the certificate every 6 hours, from one of the Monitor’s locations. That location is chosen when the Monitor is created, and the Checks card names it. While it is unavailable, another of the Monitor’s locations reads the certificate instead. You cannot change how often it is read: a certificate changes a few times a year, and the Uptime Check already checks it on every run.

The card shows when the certificate expires, how many days are left, and who issued it.

Warnings before it expires

The Check warns 30 days, 14 days and 7 days before it expires. Each warning is said once. A certificate we first read with fewer days left is warned about once, at the nearest of those days, and not once for each.

Warnings arrive in the daily digest, at 09:00 in your Project’s timezone. When you renew the certificate, its expiry date moves on, and the warnings start again for the new date. A warning still waiting for the digest when you renew is not sent.

What fails it

The Check fails when the certificate has expired, or when browsers would not trust it: it is self-signed, its chain is not trusted, it was issued for another name, or it is not valid yet. A failed Certificate Check opens an Incident and alerts you. It does not count against your uptime, and it does not show on your Status page.

A run that could not reach the server read no certificate, so it decides nothing about it. The Uptime Check tells you about a server that does not answer.

An expired certificate is first heard as down

The Uptime Check checks the certificate on every run of an https Monitor. So when the certificate expires, or stops being trusted, the Uptime Check fails too, and your visitors cannot reach the site either. You hear the uptime alert first: it says the Monitor is down, and that its certificate expired.

The Certificate Check’s own failure waits behind it, like any Check’s, and is looked at again once your Monitor is up. If the certificate is fine by then, you never hear about it. If it still fails, you hear about it after the message that says your Monitor is up again.