SSL certificate monitoring that warns before expiry

The TLS certificate check warns before a certificate expires, 14 days ahead by default, and checks that it is trusted. With automatic discovery on, TarleyNode also adds an HTTPS certificate check after every scan to any device that answers HTTPS, and mail server checks report the days left on their certificates.

Request a demoAll features
The incident inbox with five open incidents: two critical, printer-fl2-01 and ap-warehouse-03 not answering ping, the second acknowledged; and three warnings, disk /srv above 85% on srv-files-01, an HTTPS certificate on srv-web-01 expiring in 12 days, and errors above 10 per minute on Gi1/0/12 of core-sw-02.

What it checks

  • TLS certificate expiry and trust, on any port, 443 by default.
  • Certificates from an internal or self-signed authority, for expiry only, when you tick that option.
  • With automatic discovery on, an HTTPS certificate check, added after every scan to each device that answers HTTPS. Remove one and it is not added back.
  • SMTP, IMAP and POP3 mail servers over STARTTLS or TLS, with the certificate’s days left.
  • HTTP and HTTPS availability, and multi-step web transactions, including sign-in.

Set it up

  1. Open the device’s page, choose Add check and pick TLS certificate.
  2. Set the Port, and the Certificate name if it differs from the device’s host name.
  3. Set Alert when fewer days remain, from 1 to 365 days; it starts at 14.
  4. Tick Only track expiry for certificates from an internal or self-signed authority for internal certificates.
  5. Save. Under Notifications, choose who hears when a certificate is close to expiry. A certificate close to expiry then shows in the incident inbox, like the HTTPS certificate in the screenshot above.

Mail servers

Add a Mail server (SMTP, IMAP or POP3) check, choose how it is secured, STARTTLS, TLS from the start or none, and the usual port fills in. It waits for the server’s greeting and checks the certificate, then disconnects without signing in or sending mail. Set Fail when the certificate has fewer days left; it starts at 14.

Questions

How early does TarleyNode warn about an expiring certificate?

14 days before expiry by default. Alert when fewer days remain can be set from 1 to 365 days.

Can it watch certificates from our own certificate authority?

Yes. Tick Only track expiry for certificates from an internal or self-signed authority, and the check watches expiry only.

Do I have to add a check for every web server?

Not with automatic discovery on: after every scan, a device that answers HTTPS gets an HTTPS certificate check by itself.

Who is told when a certificate is about to expire?

Whoever you choose under Notifications, by email, Teams, Slack, Google Chat, PagerDuty, Telegram, SMS, Jira, ServiceNow or a webhook, with escalation until someone acknowledges the incident.

Can it check that a website answers, not only its certificate?

Yes. HTTP / HTTPS checks the status code and, optionally, text on the page, and Web transaction opens pages in order, such as a sign-in, and names the step that failed. DNS lookup checks that a name resolves, optionally to an expected answer.

Does every certificate need its own licence?

No. Each TLS certificate check is one sensor, one check on one device, counted like any other check.

Does it check mail server certificates?

Yes. The mail server check reports the certificate’s days left and fails when fewer remain than you set.

Related

TarleyNode is offered by invitation while it is new. Request a demo to try it on your own network.