# tlscert

Source: https://www.pingtower.com/docs/addons/tlscert/

Complete a TLS handshake and report how long the leaf certificate has left. Reported on every run, so the threshold lives in a rule, not the agent.

## Parameters

| Parameter | Default | Meaning |
| --- | --- | --- |
| `address`<span class="req">REQUIRED</span> | | `host` or `host:port`; port defaults to 443. |
| `server_name` | host from `address` | SNI to present when it differs. |
| `warn_before` | `504h` (21 days) | Expiry closer than this is **down**. |

An untrusted or already expired certificate is **down**, with issuer, subject and expiry still filled in, because "which certificate, expiring when, rejected why" is the whole diagnosis. There is deliberately no parameter to skip verification.

## Measurements

`days_until_expiry` (negative once expired), `handshake_ms`, `chain_length`.

## A rule for it

```json
{"name":"cert-expiring","match":{"tags":["addon:tlscert"]},
 "conditions":[{"key":"days_until_expiry","op":"lte","value":14}],
 "identifier_keys":["check"],"renotify_minutes":1440}
```