Pingtower
Docs
tlscert
Complete a TLS handshake and report how long the leaf certificate has left. Reported on every run, so the threshold lives in a rule, not the agent.
Parameters
| Parameter | Default | Meaning |
|---|---|---|
addressREQUIRED | host or host:port; port defaults to 443. | |
server_name | host from address | SNI to present when it differs. |
warn_before | 504h (21 days) | Expiry closer than this is down. |
An untrusted or already expired certificate is down, with issuer, subject and expiry still filled in, because “which certificate, expiring when, rejected why” is the whole diagnosis. There is deliberately no parameter to skip verification.
Measurements
days_until_expiry (negative once expired), handshake_ms, chain_length.
A rule for it
{"name":"cert-expiring","match":{"tags":["addon:tlscert"]},
"conditions":[{"key":"days_until_expiry","op":"lte","value":14}],
"identifier_keys":["check"],"renotify_minutes":1440}