---
title: Certificates & domains
description: Catch expiring TLS certificates, broken chains, weak TLS configurations (daily A+ to F grade) and lapsing domain registrations before they take you offline.
canonical: https://watchfor.io/docs/monitors/certificates
---

# Certificates & domains

Catch expiring TLS certificates, broken chains, weak TLS configurations (daily A+ to F grade) and lapsing domain registrations before they take you offline.

Two of the most common (and most embarrassing) outages are an expired TLS
certificate and a lapsed domain. These monitors make sure neither sneaks up on
you — and, on supported plans, they also tell you how good your TLS
configuration actually is.

## SSL / TLS certificate

Connects to your service, inspects the certificate chain, and tracks the
things that matter:

- **Days until expiry** — the headline number, on an overview card.
- **Issuer, subject and validity** — who issued it, for which names, and
  whether it is already expired or not yet valid.
- **Hostname match** and **chain validity** — whether the certificate covers
  the name you connect to and chains to a trusted root.
- **TLS health** — the negotiated TLS version, cipher suite and whether the
  connection has forward secrecy. Servers that only accept outdated ciphers
  are still monitored — the check automatically falls back to a
  legacy-compatible handshake — and get flagged with a **Legacy TLS** badge so
  you know the server's configuration needs updating.

**Target:** a domain (`example.com`, port 443) or `host:port` for mail,
database or other TLS services.

| Setting | Notes |
| --- | --- |
| **Port** | Default 443. |
| **Server Name (SNI)** | Send a different name in the handshake — useful when the target is an IP or a load balancer. |
| **Allow Insecure** | Keep checking a certificate that fails validation (self-signed, private CA) instead of failing the check. |
| **Track TLS grade** | On by default on plans that include the daily [TLS grade](#tls-grade); switch it off to skip the grade scan. Locked off on other plans. |
| **Timeout** and **IP version** | Seconds; Auto / IPv4 / IPv6. |

### Alert rules

| Preset | Default | Fires when |
| --- | --- | --- |
| **Probe Status** | on | The TLS connection can't be established. |
| **Certificate Expiry** | on (warning, 14 days) | Fewer than *N* days remain. Raise it to 30 if your renewal automation runs late. |
| **Hostname Match** | off | The certificate doesn't cover the hostname. |
| **Certificate Chain** | off | The chain is incomplete or not trusted. |
| **Minimum TLS Version** | off | The server negotiates below your floor (`12` = TLS 1.2, `13` = TLS 1.3). |

> **Info**
>
> Set the expiry warning comfortably before your renewal automation runs —
> that way the alert is an early heads-up, not a fire drill. HTTP, API, MCP,
> TCP-with-TLS and WebSocket monitors also record days until expiry, so you
> rarely need a separate SSL monitor for a site you already monitor over
> HTTPS; use one for mail, database and other non-HTTP TLS endpoints, or when
> you want the grade.

### TLS grade

On plans that include it, an SSL monitor also tracks a **TLS grade** — the
same **A+ to F** rating as the free [SSL/TLS Grade Checker](/ssl-grade-checker),
shown on the monitor with the exact findings behind it. New SSL monitors on
those plans start with **Track TLS grade** on; switch it off in the monitor's
settings if you only want certificate checks. Monitors created before the
option existed have it off until you turn it on.

The certificate check keeps running at its normal interval; only the heavier
grade scan (every protocol version, weak-cipher probes, HSTS, OCSP stapling,
CAA) runs **once every 24 hours per monitor**, on a single check from one of
its locations — six locations still mean one scan a day against your server.
The first grade arrives with the very next check after the monitor is created
or the option is turned on, and **Check now** always rescans. Between scans
the monitor keeps showing the last grade and when it was taken. A **TLS
Grade** alert rule is evaluated by that daily scan and by every Check now: an
incident opens with the scan that finds the problem and resolves with the
first scan that no longer does.

How the grade is built — it starts at **A**, the worst problem caps it, and
only a spotless configuration is promoted to **A+**:

| Finding | Effect |
| --- | --- |
| Certificate not trusted, name mismatch or expired | **T** (not trusted) — overrides the scale |
| RSA key below 2048 bits, SHA-1/MD5 signature, SSL 3.0 enabled, NULL/EXPORT/DES ciphers | capped at **F** |
| No TLS 1.2 or 1.3, RC4 or 3DES accepted | capped at **C** |
| TLS 1.0/1.1 enabled, no forward secrecy | capped at **B** |
| TLS 1.3, no TLS 1.0/1.1, no weak ciphers, forward secrecy, HSTS with max-age ≥ 180 days | **A+** |

Post-quantum key exchange, HTTP/2, OCSP stapling and a CAA record are reported
as positive findings.

To be alerted when the grade drops, enable the **TLS Grade** preset in the
monitor's Alerting tab and pick the lowest grade you accept (A+, A, B or C);
the default is B. Through the API the grade is a numeric alert metric,
`metrics['tlsgrade.grade_score']`: **A+** = 6, **A** = 5, **B** = 4,
**C** = 3, **T** = 1, **F** = 0 — `grade_score < 5` means "alert if the grade
drops below A".
The metric is listed in the [type catalog](/docs/api/monitor-types#ssl--tls)
and can equally be used in
[alert rules created through the API](/docs/api/alert-rules#create-a-rule).

> **Info**
>
> The grade is refreshed daily, so a configuration regression can take up to
> 24 hours to surface — it is a posture check, not a real-time signal. After
> changing your TLS setup, use **Check now** to see the new grade at once.

## Domain expiry

Watches a **domain's registration** and tells you when it is approaching
expiry. The monitor is created with a **Domain Expiry** rule already on
(warning at 30 days), so protection starts the moment you add it.

**Target:** the registrable domain only — `example.com`, not
`www.example.com`.

- **Days until expiry** and the expiry date, from the registry's RDAP
  service, with a WHOIS fallback for registries without RDAP.
- **Registrar**, **name servers**, **status codes** and creation / update
  dates, where the registry publishes them.
- **Confirmation-exempt:** registries rate-limit lookups, so there is no
  accelerated re-check; the rule opens an incident on the first check that
  crosses your threshold. The generic **Probe Status** rule exists but is
  **off by default** — a registry that is briefly unreachable is not your
  domain's problem; turn it on only if you want to know about lookup
  failures.

Some registries (a few country-code TLDs) don't publish an expiry date at
all. In that case the monitor shows the registration data it did get, the
status stays **Unknown**, and no false "expiring" alert fires.

Free: [WHOIS lookup](/whois-lookup), [SSL checker](/ssl-checker).

## Also via API

Create with `type: "ssl"` (config: `port`, `serverName`, `insecure`,
`trackTlsGrade`) or `type: "rdap"` — see [Monitors API](/docs/api/monitors)
and the type catalog for [SSL / TLS](/docs/api/monitor-types#ssl--tls) and
[Domain (RDAP)](/docs/api/monitor-types#domain-rdap).

---

Canonical page: https://watchfor.io/docs/monitors/certificates · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt