SSL certificate and domain expiry monitoring

The certificate check opens its own TLS connection to the host and inspects what the server presents. That is more work than reading a response header, and it is the only way to see the things that actually break trust:

• Chain trust — whether the certificate validates to a root your visitors’ browsers carry, not just whether one was served.
• Hostname match — a perfectly valid certificate for the wrong name is a full-page browser warning.
• Protocol version — what was actually negotiated.
• Expiry — with a warning window you control.

Default interval

6 hours

Minimum interval

1 hour

Warning

21 days out

Critical

7 days out

The port is configurable, so a mail or API endpoint on a non-standard port is checkable too. Both hostname verification and chain authorisation can be relaxed for a staging host with a self-signed certificate — deliberately, and visibly, rather than by the check quietly not noticing.

A domain lapsing takes everything with it, and unlike a certificate there is no automated renewal quietly handling it in the background. Pulse asks the registry directly over RDAP — the structured, modern replacement for WHOIS — for the registration expiry date and the registrar status codes.

Default interval

1 day

Minimum interval

6 hours

Warning

30 days out

Critical

7 days out

One honest caveat, and the check says so rather than guessing: some registries do not publish an expiry date at all. When that happens the result is reported as unknown and shown as degraded. It does not raise an alert, because there is nothing to alert about — but it also does not quietly show green and let you believe the date is being watched.

The six-hour floor is there because registry RDAP servers rate-limit and then block source addresses that poll them. A date that moves once a year does not need checking every five minutes.

Both checks use two thresholds rather than one. Inside the warning window the check is reported as degraded — visibly amber, with the day count, but no incident and no page. Inside the critical window, or once it has actually expired, it fails.

Degraded is doing real work there. It means “this needs a human this month, not tonight”, and having somewhere to put that is what stops the three weeks before a renewal from being three weeks of ignorable red.