SSL Certificate Monitoring

Automated SSL/TLS certificate monitoring with 12-hour check intervals. Get notified before certificates expire to prevent service disruptions.

Automated Checks

Cron job runs every 12 hours to check all monitored domains. Performs TLS handshake and parses certificate details.

Expiry Alerts

Configurable notification thresholds (default: 30 days before expiry). Escalating severity as expiration approaches.

Failure Detection

Detects DNS failures, timeouts, handshake errors, and hostname mismatches with immediate high-severity alerts.

Domain Properties

Field	Type	Description
hostname	string	Domain name to monitor (e.g., example.com)
port	integer	Port to check (default: 443)
sniHostname	string	SNI hostname if different from hostname
status	enum	active, paused, archived
lastCheckedAt	timestamp	Last successful check timestamp
nextCheckAt	timestamp	Scheduled next check timestamp

Check Result Statuses

OKCertificate valid and not expiring soon

WarningValid but expiring within threshold

ExpiredCertificate has expired

Handshake FailedTLS handshake could not complete

DNS FailedDomain name resolution failed

TimeoutConnection timed out

Hostname MismatchCertificate CN does not match hostname

SSL Check Algorithm

1. DNS Resolution

Resolve hostname to IP address. If fails → DNS_FAILED

2. TCP Connection

Connect to port (default 443) with 10s timeout. If fails → TIMEOUT

3. TLS Handshake

Perform TLS handshake and retrieve certificate. If fails → HANDSHAKE_FAILED

4. Certificate Validation

Check validity dates, hostname match, and issuer chain

5. Store Results

Save to ssl_check_results with parsed certificate data

SSL Notification Recipients

Configure dedicated email recipients for SSL expiry notifications separately from general notification routes. This allows IT teams to receive certificate alerts.

Configure via: Settings → SSL Recipients

Set notification lead time: default 30 days before expiry

Multiple recipients supported with individual lead time preferences

Cron Job Configuration

SSL checks run automatically via Vercel Cron jobs. Configure in vercel.json:

{
  "crons": [
    {
      "path": "/api/cron/ssl-scan",
      "schedule": "0 */12 * * *"
    }
  ]
}