Concepts Checks SSL

SSL Check

The SSL check opens a TLS connection to a host and inspects the certificate it presents. Its real value is not the up/down verdict — a working site is UP right up until the moment its certificate expires — but the days-remaining measurement, which lets you be warned well before a certificate lapses and causes an outage.

Source: SslCheck.cs · SslCheckConfig.cs

What it checks

The probe performs a TLS handshake and reads the certificate. It reports Down in only two situations: the handshake fails, or the certificate has already expired. In every other case it reports Up and emits the number of days until expiry as the CertExpiry dimension. Deciding that "9 days left" is worth a warning and "2 days left" is worth paging is not the check's call — it is the job of the Alerts you set on CertExpiry.

This split is deliberate: availability (is the TLS endpoint answering?) and health (how much runway does the certificate have?) are two different signals, and the check keeps them separate instead of collapsing an expiring-soon certificate into a fake outage.

Configuration

Field	Default	Description
host	—	Host whose TLS certificate to check (required)
port	443	TLS port to connect to

Dimensions

Dimension	Unit	Direction	Meaning
Status	—	—	The availability outcome (UP/DOWN), for availability alerts
CertExpiry	days	lower is worse	Days remaining until the certificate expires

The handshake latency is also measured and recorded on the data point, but CertExpiry is the dimension you will normally alert on.

Outcomes

Outcome	When
UP	Handshake succeeded and the certificate has not expired (emits CertExpiry)
DOWN	The certificate has already expired, or the handshake / connection failed
FAILURE	The check couldn't run — host not configured

The check never reports DEGRADED. To be warned as a certificate approaches expiry, layer two Alerts on the same CertExpiry dimension with different thresholds — for example a Warning at 30 days and a Critical at 7.

Examples

Standard HTTPS site

{ "host": "example.com" }

HTTPS API on a custom port

{ "host": "api.example.com", "port": 8443 }

Related

• Checks — the shared model: outcome plus dimensions, and how severity is layered on top.
• Alerts — configure the warning/critical expiry thresholds on CertExpiry.
• HTTP Check — pair SSL with an HTTP check to monitor both the endpoint and its certificate.