Certificate Compliance Report
The Compliance Report shows the state of your certificates and their checks over an audit period, and exports it as evidence for security audits, compliance reviews and regulatory submissions. Open it from Certificate & TLS Monitoring ➡️ Compliance.
Audit Period and Scope
Pick the audit period with the date picker beside the Export button. It defaults to the last 90 days and can cover up to a year. The period is in UTC days, in the page and in both exports.
The Scope card under the summary lists the tags on your monitors, with how many monitors have each. By default the report covers All Monitors; pick one or more tags to limit it to the monitors with any of them (OR logic), and click All Monitors to go back to the whole account. Archived monitors are included for a period they were checked in.
The page and both exports follow the period and scope you pick.
Summary
The summary card leads with the audit period's result: the share of its checks that passed (for example 99.9% of Checks Passed). Under it:
- how the monitors fared, in one line: "18 of 32 monitors had errors in this period: 16 recovered, and 2 still had errors when it ended". A monitor recovered when it had a clean check after its last error, before the period ended.
- a strip of the period's days (weeks, for a period longer than 120 days), each shaded by the share of monitors with errors, like the health calendar on the overview.
The summary also counts the monitors by their current status:
| Status | Description |
|---|---|
| Valid | The certificate is within its validity period and passed its checks. |
| Expiring Soon | The certificate is within an expiration alert threshold set on its profile. |
| Expired | The certificate has passed its expiration date. |
| Error | The latest check found an error. |
Exporting
The Export button offers Export as PDF and Export as CSV. Both are in UTC, and say so.
PDF Report
The PDF is a portrait document for attaching to audit evidence packages:
- Summary: the same summary card as the page, with the account, the audit period and who generated the report.
- Certificate inventory: a table with a row per monitor (monitors still waiting for their first check are grouped separately): its issuer, validation level, key, serial number, revocation and chain trust results, expiry, and the share of its checks that passed during the period.
- Issues: a card for each monitor with a problem now or errors during the period, with each error explained, the days it had errors, and when they were resolved.
- Methodology, field definitions and compliance coverage: how the checks work, what each field in the report means, and the frameworks below.
CSV Export
The CSV is a flat file for GRC platforms (ServiceNow, Archer, Vanta and the like) or spreadsheets. Its first rows hold the report's details: when it was generated, a Time Zone line (all dates and times in the file are UTC), the audit period, and the tags it was limited to. Then there's a row per monitor:
| Column | Description |
|---|---|
| Monitor ID | The monitor's unique identifier (SID). |
| Display Name | The monitor's name in the portal. |
| Host | The host and port being monitored. |
| Protocol | The connection protocol (HTTPS, SMTP, IMAP, ...). |
| Common Name | The certificate's Common Name. |
| Issuer | The certificate authority that issued the certificate. |
| Certificate Type | The certificate's validation level, or blank if it can't be told. |
| Serial Number | The certificate's serial number in hex. |
| Valid From | The start of the certificate's validity period. |
| Expiry Date | The certificate's expiration date. |
| Days Remaining | Days until expiration at the last check. |
| Key / Algorithm | The key type and size, and the signature algorithm. |
| SANs | The Subject Alternative Names, comma-separated. |
| Revocation | The revocation result: Passed, Failed, or Not checked. |
| Chain Trust | The chain trust result: Trusted, Untrusted, or Unknown. |
| Status | The monitor's current status (Valid, Expiring Soon, Expired, Error, Pending First Check). |
| Last Checked | When the latest check ran. |
| Checks Passed % | The share of the period's checks that passed, to one decimal place. |
| First Check | The first check in the period. |
| Last Check | The last check in the period. |
| Full Period Coverage | Yes if the monitor was checked for the whole period, No otherwise. |
| First Error Date | The first day with errors in the period (blank if none). |
| Last Error Date | The last day with errors in the period (blank if none). |
| Resolved Date | The day of the first clean check after the last error (blank if unresolved or no errors). |
Compliance Coverage
The report is evidence for these controls. It documents your certificates and their checks; it doesn't certify compliance on its own.
| Framework | Control | What it requires |
|---|---|---|
| PCI DSS 4.0.1 | Requirements 4.2.1 and 4.2.1.1 | Strong cryptography for card numbers sent over open, public networks, valid certificates, and an inventory of trusted keys and certificates. |
| HIPAA | §164.312(e)(1) Transmission Security | Guarding electronic protected health information sent over networks. Encryption is addressable today, and HHS has proposed making it required. |
| ISO 27001:2022 | Annex A 8.24 | Use of cryptography, including key management; the ISO 27002 guidance covers certificates. |
| NIST SP 800-53 Rev. 5 | SC-8, SC-12, SC-17 | Protecting data in transit, key management, and certificates from approved policies and trust anchors. |
| SOC 2 | CC6.7 and CC7.2 | Protecting information in transit, and monitoring for anomalies. |