Monitortypen
SSL/TLS certificate monitors
Catch expiring, expired, self-signed and misconfigured TLS certificates on any host and port before browsers and API clients start rejecting them.
- API type
ssl- You enter
- Hostname or IP
- Default port
- 443
- Runs at most every
- 1 hour
- Needs
- None
FastPing opens a TLS connection to the host and port, sending the hostname as SNI so that servers hosting several sites present the right certificate. It then checks:
- that the certificate chains to a publicly trusted certificate authority, with every intermediate certificate sent by the server;
- that the certificate covers the hostname you entered;
- how many days remain before it expires.
The monitor is down when the certificate is invalid for any of these reasons, in warning when it expires within your warning period (14 days unless you change it), and up otherwise, for example Valid, 61 days left (Let's Encrypt). The response time shown is the duration of the TLS handshake. Certificates change rarely, so this check runs at most once an hour.
| Field | API option | Default | Notes |
|---|---|---|---|
| Hostname, domain or IP | host | Required | Public hostname or IP address |
| Port | port | 443 | 1 to 65535 |
| Warn this many days before expiry | warnDays | 14 | 1 to 120 |
| Check interval | interval | Your plan's minimum | Never more often than every hour |
Any port that speaks TLS from the first byte works: 443 for HTTPS, 465 for SMTPS, 993 for IMAPS, 995 for POP3S, 8443 and so on. Services that start in plain text and upgrade with STARTTLS (SMTP on 25 or 587, for example) cannot be checked by this monitor. Use a mail server monitor with STARTTLS for those.
Certificates from ACME authorities such as Let's Encrypt are normally renewed automatically about 30 days before they expire. With the default warning period of 14 days, a warning therefore means that automatic renewal has been failing for around two weeks: check your ACME client's logs, DNS records used for validation and firewall rules for port 80.
For certificates you renew by hand, choose a longer period (up to 120 days) so that the warning arrives while there is time to buy, validate and install the new certificate.
| Message | What it means | What to do |
|---|---|---|
Invalid certificate: CERT_HAS_EXPIRED | The certificate is past its expiry date. | Renew it and reload the server. |
Invalid certificate: UNABLE_TO_VERIFY_LEAF_SIGNATURE | The server does not send the intermediate certificate. Browsers often hide this problem; API clients, mobile apps and FastPing do not. | Serve the full chain (with Let's Encrypt: fullchain.pem). Then use the SSL checker to confirm the chain. |
Invalid certificate: DEPTH_ZERO_SELF_SIGNED_CERT | The certificate is self-signed. | Install a certificate from a public certificate authority. |
Invalid certificate: SELF_SIGNED_CERT_IN_CHAIN | The chain ends in a root certificate that is not publicly trusted (often a company or test CA). | Use a publicly trusted certificate on public endpoints. |
Invalid certificate: ERR_TLS_CERT_ALTNAME_INVALID | The certificate does not cover the hostname you entered. | Add the hostname to the certificate, or check that the right site answers for that name (SNI). |
Invalid certificate: CERT_NOT_YET_VALID | The certificate's start date is in the future. | Check the server clock, or wait until the new certificate becomes valid. |
TLS handshake timed out. | No TLS answer within 10 seconds. | Check that the port really speaks TLS and is reachable. |
Certificate expires in 9 days | Warning: the certificate is inside your warning period. | Renew it, or fix automatic renewal. |
The free SSL checker shows the full chain, protocol, cipher and validity dates.