Give TLS certificates an early heads-up

Set a certificate lookout

1. Open Monitors and choose Add monitor. Owners and admins need permission to manage the monitor.
2. Choose TLS certificate and enter an HTTPS hostname, optionally with a port, such as https://example.com:8443/. Paths and query strings are not supported.
3. Choose the warning window: 1–90 whole days before expiry, with 14 days as the default. New certificate monitors start with an hourly check interval.
4. Review the timeout, confirmation thresholds and notification settings, then save. All plans can use certificate monitors within their monitor allowances and minimum intervals.

What your owl checks

Each check opens one short TLS connection and verifies the certificate chain, hostname and validity dates. No HTTP request, credentials or application message is sent. The timeout covers DNS and the complete connection. Response time measures that check, not application response time.

We inspect the leaf certificate presented by the public endpoint. If you use a CDN or reverse proxy, this is its public certificate, not a hidden origin certificate. Private endpoints, self-signed or privately trusted certificates, client certificates and STARTTLS are not supported.

A warning before renewal time

The monitor reports down when a certificate is invalid, cannot be verified, or has reached the configured expiry window. This means the certificate needs attention; it does not necessarily mean the application is unavailable. Use a separate HTTP/API monitor for application availability.

Existing confirmation thresholds, maintenance and notification preferences apply. A confirmed change starts the usual incident and alerts; a renewed, trusted certificate outside the warning window returns the monitor to healthy. We do not send daily expiry countdown reminders.

The monitor card shows the latest verified expiry date in UTC. Failed verification clears that date rather than showing stale information. Certificate health contributes to this monitor’s history and any widget or status-page component you choose to publish. Give it a clear name, such as Main API certificate.

Change or move your lookout

Pause, resume and Check now work like other monitors. Export and import preserve the warning window; imported monitors start paused. Certificate metadata is not included in exports or public widgets.

To convert a monitor with protected HTTP or WebSocket details, first remove those saved details. Certificate checks cannot use HTTP methods, response rules, WebSocket options or authentication. Existing check history remains, so a new separate monitor is often clearer when changing what you measure.