---
title: Certificates & domains
description: Catch expiring TLS certificates, broken chains, weak TLS configurations (daily A+ to F grade) and lapsing domain registrations before they take you offline.
canonical: https://watchfor.io/docs/monitors/certificates
---

# Certificates & domains

Catch expiring TLS certificates, broken chains, weak TLS configurations (daily A+ to F grade) and lapsing domain registrations before they take you offline.

Two of the most common (and most embarrassing) outages are an expired TLS
certificate and a lapsed domain. These monitors make sure neither sneaks up on
you — and, on supported plans, they also tell you how good your TLS
configuration actually is.

## SSL / TLS certificate

Connects to your service, inspects the certificate chain, and tracks the
things that matter:

- **Days until expiry** — the headline number, on an overview card.
- **Issuer, subject and validity** — who issued it, for which names, and
  whether it is already expired or not yet valid.
- **Hostname match** and **chain validity** — whether the certificate covers
  the name you connect to and chains to a trusted root.
- **TLS health** — the negotiated TLS version, cipher suite and whether the
  connection has forward secrecy. Servers that only accept outdated ciphers
  are still monitored — the check automatically falls back to a
  legacy-compatible handshake — and get flagged with a **Legacy TLS** badge so
  you know the server's configuration needs updating.

**Target:** a domain (`example.com`, port 443) or `host:port` for mail,
database or other TLS services.

| Setting | Notes |
| --- | --- |
| **Port** | Default 443. |
| **Server Name (SNI)** | Send a different name in the handshake — useful when the target is an IP or a load balancer. |
| **Allow Insecure** | Keep checking a certificate that fails validation (self-signed, private CA) instead of failing the check. |
| **Track TLS grade** | On by default on plans that include the daily [TLS grade](#tls-grade); switch it off to skip the grade scan. Locked off on other plans. |
| **Timeout** and **IP version** | Seconds; Auto / IPv4 / IPv6. |

### Alert rules

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The TLS connection can't be established. |
| **Certificate Expiry** | on (warning, 14 days; critical off) | Fewer than *N* days remain. Two levels — see [Expiry levels and reminders](#expiry-levels-and-reminders). Raise the warning to 30 if your renewal automation runs late. |
| **Hostname Match** | off | The certificate doesn't cover the hostname. |
| **Certificate Chain** | off | The chain is incomplete or not trusted. |
| **Minimum TLS Version** | off | The server negotiates below your floor (`12` = TLS 1.2, `13` = TLS 1.3). |

> **Info**
>
> Set the expiry warning comfortably before your renewal automation runs —
> that way the alert is an early heads-up, not a fire drill. HTTP, API, MCP,
> TCP-with-TLS and WebSocket monitors also record days until expiry, so you
> rarely need a separate SSL monitor for a site you already monitor over
> HTTPS; use one for mail, database and other non-HTTP TLS endpoints, or when
> you want the grade.

### TLS grade

On plans that include it, an SSL monitor also tracks a **TLS grade** — the
same **A+ to F** rating as the free [SSL/TLS Grade Checker](/ssl-grade-checker),
shown on the monitor with the exact findings behind it. New SSL monitors on
those plans start with **Track TLS grade** on; switch it off in the monitor's
settings if you only want certificate checks. Monitors created before the
option existed have it off until you turn it on.

The certificate check keeps running at its normal interval; only the heavier
grade scan (every protocol version, weak-cipher probes, HSTS, OCSP stapling,
CAA) runs **once every 24 hours per monitor**, on a single check from one of
its locations — six locations still mean one scan a day against your server.
The first grade arrives with the very next check after the monitor is created
or the option is turned on, and **Check now** always rescans. Between scans
the monitor keeps showing the last grade and when it was taken. A **TLS
Grade** alert rule is evaluated by that daily scan and by every Check now: an
incident opens with the scan that finds the problem and resolves with the
first scan that no longer does.

How the grade is built — it starts at **A**, the worst problem caps it, and
only a spotless configuration is promoted to **A+**:

| Finding | Effect |
| --- | --- |
| Certificate not trusted, name mismatch or expired | **F**, labelled "Not trusted" — browsers show a full-page warning, so nothing else can lift it; the finding names which check failed |
| RSA key below 2048 bits, SHA-1/MD5 signature, SSL 3.0 enabled, NULL/EXPORT/DES ciphers | capped at **F** |
| No TLS 1.2 or 1.3, RC4 or 3DES accepted | capped at **C** |
| TLS 1.0/1.1 enabled, no forward secrecy | capped at **B** |
| TLS 1.3, no TLS 1.0/1.1, no weak ciphers, forward secrecy, HSTS with max-age ≥ 180 days | **A+** |

Post-quantum key exchange, HTTP/2, OCSP stapling and a CAA record are reported
as positive findings.

To be alerted when the grade drops, enable the **TLS Grade** preset in the
monitor's Alerting tab and pick the lowest grade you accept (A+, A, B or C);
the default is B. Through the API the grade is a numeric alert metric,
`metrics['tlsgrade.grade_score']`: **A+** = 6, **A** = 5, **B** = 4,
**C** = 3, **F** = 0 — `grade_score < 5` means "alert if the grade drops
below A". Until October 2026 an untrusted certificate was graded **T** (score
1); it is **F** (score 0) now. Rules with a threshold of 3 to 6, which is every
choice the preset offers, fire exactly as before.
The metric is listed in the [type catalog](/docs/api/monitor-types#ssl--tls)
and can equally be used in
[alert rules created through the API](/docs/api/alert-rules#create-a-rule).

> **Info**
>
> The grade is refreshed daily, so a configuration regression can take up to
> 24 hours to surface — it is a posture check, not a real-time signal. After
> changing your TLS setup, use **Check now** to see the new grade at once.

## Domain expiry

Watches a **domain's registration** and tells you when it is approaching
expiry. The monitor is created with a **Domain Expiry** rule already on
(warning at 30 days), so protection starts the moment you add it.

**Target:** the registrable domain only — `example.com`, not
`www.example.com`.

- **Two levels and reminders** — the Domain Expiry rule has the same
  warning / critical levels and reminder days as certificates (see
  [Expiry levels and reminders](#expiry-levels-and-reminders)); the slider
  goes up to 365 days.
- **Days until expiry** and the expiry date, from the registry's RDAP
  service, with a WHOIS fallback for registries without RDAP.
- **Registrar**, **name servers**, **status codes** and creation / update
  dates, where the registry publishes them.
- **Confirmation-exempt:** registries rate-limit lookups, so there is no
  accelerated re-check; the rule opens an incident on the first check that
  crosses your threshold. The generic **Probe Status** rule exists but is
  **off by default** — a registry that is briefly unreachable is not your
  domain's problem; turn it on only if you want to know about lookup
  failures.

Some registries (a few country-code TLDs) don't publish an expiry date at
all. In that case the monitor shows the registration data it did get, the
status stays **Unknown**, and no false "expiring" alert fires.

If the registry has **no record of the domain** at all — it was never
registered, or it expired and was deleted — the check fails and the
Overview says "Domain not found in the registry". Turn on the **Probe
Status** rule if you want an incident for that too.

Free: [WHOIS lookup](/whois-lookup), [SSL checker](/ssl-checker).

## Expiry levels and reminders

The **Certificate Expiry** card (SSL monitors, and the **SSL Certificate**
card on HTTP, API and MCP monitors) and the **Domain Expiry** card share the
same controls on the **Alerting** tab:

- **Warning** — fires when fewer than *N* days remain (default 14 for
  certificates, 30 for domains and API monitors). It opens a warning incident:
  time to renew, nothing is down yet.
- **Critical** — off by default. Switch it on (default 7 days) when an expiry
  that close should be treated as an outage: it opens a **new critical
  incident**, the monitor shows **Down**, it counts as downtime and it pages
  [on-call](/docs/alerting/on-call). The warning incident resolves quietly
  when the critical one takes over.

Each level is its own rule, so you can run warning only, critical only, or
both.

### Reminders before expiry

By default you hear once, when the incident opens. Under the sliders,
**Remind me again at** adds up to five reminder days (for example 14 and 3):
when the days left reach a reminder, the open incident's notification is sent
again, once, to the same channels — "Reminder: certificate for
shop.example.com expires in 14 days (on 2026-10-17). It has not been renewed
yet." A line under the chips previews every notice you will get, such as
*You'll hear at 30 days (warning) · 14 days (reminder) · 7 days (critical).*

- Reminders go out within about an hour of the day being reached.
- **Acknowledging** the incident stops its reminders; renewing resolves it.
- A day at or above the highest level's threshold is never sent (the
  incident only opens below it), so the chips only offer smaller values.
- Over the API set `config.expiryReminderDays` (for example `[14, 3]`, whole
  days 1–365, up to 5) on HTTP, API, MCP, SSL and Domain monitors; `null`
  removes it.

Expiry notifications say what expires and when — "🟡 Shop — certificate
expires in 29 days" — rather than "Degraded" or "Down", and the incident's
root cause and timeline show the expiry date and every reminder sent.

## Also via API

Create with `type: "ssl"` (config: `port`, `serverName`, `insecure`,
`trackTlsGrade`) or `type: "rdap"` — see [Monitors API](/docs/api/monitors)
and the type catalog for [SSL / TLS](/docs/api/monitor-types#ssl--tls) and
[Domain (RDAP)](/docs/api/monitor-types#domain-rdap).

---

Canonical page: https://watchfor.io/docs/monitors/certificates · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt