Watchdog: SSL Certificate
Monitors the remaining validity of TLS certificates for several hosts with warn and fail thresholds in days. Type ssl_cert, runner Dashboard. Fields, statuses, messages.
Watchdog: SSL Certificate
The check opens a TLS connection to each selected host, reads the certificate and calculates the remaining validity in days.
| Property | Value |
|---|---|
| Type identifier | ssl_cert |
| Runner | Dashboard |
| Target in the email | Hosts (host names, comma-separated) |
Fields
| Field | Key | Default | Meaning |
|---|---|---|---|
| URLs to check | hosts |
Required. Selection from the client's URLs, the host name of the URL is stored | |
| Port | port |
443 |
TCP port of the TLS connection, applies to all hosts |
| Warn threshold (days) | warn_days |
14 |
WARN if the certificate expires in at most this many days |
| Fail threshold (days) | fail_days |
3 |
FAIL if the certificate expires in at most this many days |
| Timeout (seconds) | timeout |
10 |
Connection time limit |
| Allow self-signed | allow_self_signed |
off | Accept self-signed and internal-CA certificates |
The fail threshold should be smaller than the warn threshold. The form does not validate this.
For the Allow self-signed option the form submits an empty value, which the save logic skips. The option therefore cannot be enabled in the UI, and the check always runs with full certificate verification.
Behaviour
The connection verifies the certificate chain and the host name (verify_peer, verify_peer_name). From the expiry date the check calculates the remaining days, rounded up.
| Remaining validity per host | Status | Message |
|---|---|---|
| More than the warn threshold | OK |
<host>: valid for <n> day(s) |
| At most the warn threshold | WARN |
<host>: expires in <n> day(s) |
| At most the fail threshold | FAIL |
<host>: expires in <n> day(s) |
| Expired | FAIL |
<host>: expired |
| Connection or TLS verification fails | FAIL |
Connection to <host>:<port> failed: <reason> |
| Certificate unreadable | FAIL |
No SSL options in stream context after handshake, No peer certificate captured, Failed to parse certificate or Certificate has no validTo_time_t field |
| No host configured | UNKNOWN |
No hosts configured |
With several hosts the worst status wins. The message lists the problem hosts and counts the healthy ones ((2 OK)). If all are fine it reads N hosts — all OK (min. Xd) with the shortest remaining validity.
Certificates whose chain cannot be verified (for example from a private CA) lead to FAIL with the connection's error message.