Skip to main content

Getting Started with Certificate Monitoring

This guide walks you through setting up your first certificate monitor and understanding the results.

What You'll Accomplish​

By the end of this guide, you'll have:

  • Created your first certificate monitor
  • Viewed a detailed certificate report
  • Reviewed the certificate chain validation
  • Configured alert notifications

Prerequisites​

You'll need an active Generator Labs account with certificate monitoring enabled. If you haven't signed up yet, visit the Certificate Monitoring pricing page to get started.

Step 1: Verify Your Contact Groups​

Before creating monitors, ensure you have contact groups configured to receive alerts. Navigate to Contacts ➡️ Manage ➡️ Groups. Every new account includes a Default Contact Group with your account email address.

To add additional contacts or create new contact groups, click Add Contact or Add Contact Group. You can configure email, SMS, Slack, and other notification methods. For now, the Default Contact Group is sufficient to get started.

Step 2: Create Your First Monitor​

Navigate to Certificate & TLS Monitoring ➡️ Manage ➡️ Monitors and click Add Monitor.

Configure your first monitor:

Display Name: Choose a descriptive name like "Production Web Server" or "Company Website"

Protocol: Select the appropriate protocol for your service. For a standard website, choose HTTPS. For mail servers, choose SMTPS or SMTP+STARTTLS depending on your configuration.

Hostname: Enter your domain name (e.g., www.example.com). You can also use IP addresses or specify custom ports like mail.example.com:2500. For your first monitor, use a domain you own or manage.

Monitoring: Leave this set to Certificate Monitoring. (Certificate & TLS Monitoring is coming soon.)

Profile: Leave this set to Default Profile (Default) for now. Profiles control validation rules and alert thresholds.

Contact Group(s): Ensure Default Contact Group is selected so you'll receive alerts.

Tags: Optionally add tags like production or webserver to organize your monitors.

Click Add Monitor to create it. Your first HTTPS monitor is free: every account gets one HTTPS monitor checked at no charge.

Step 3: View Your Certificate Report​

After you add the monitor, its page opens. It shows Pending First Check until the first check runs, shortly after, and then the result. Later, open the page by clicking the monitor's name in the monitors list.

The page opens on the Summary tab: the monitor's overall state, the software its server runs, and a Certificate card with the certificate's days left, issuer and key, and its findings by severity. Click the card to open the Certificate Report, which shows:

Findings: Anything the check found to fix, worst first, each with what it means and a How to Fix It link. If there's nothing, the report's top card says Nothing to fix.

Checks: Each check (connection, expiration, hostname, chain of trust, revocation, signature and key strength, CAA and consistency) and its result.

Certificate Chain: Each certificate from your server certificate through the intermediates to the root CA, with its own checks in plain words, such as Not expired: 126 days left.

If you see findings, follow their How to Fix It links, or see certificate findings and understanding certificate reports.

Step 4: Understanding Alerts​

With your monitor configured, you'll automatically receive alerts when:

  • The certificate reaches expiration thresholds (default: 60, 30, 15, 5 and 0 days before expiration)
  • The certificate becomes invalid or untrusted
  • The hostname doesn't match the certificate
  • Connection failures prevent certificate validation

Alerts are sent to all contacts in your configured contact groups. You'll receive notifications at each threshold, giving you multiple opportunities to renew certificates before they expire.

Step 5: Check the Overview and Findings​

Navigate to Certificate & TLS Monitoring ➡️ Overview for a dashboard of all your monitors, with a 26-week health calendar. The Findings page lists every finding across your monitors in one place, so you can see which problems repeat on several hosts and fix them together. See viewing certificate findings.

Next Steps​

Now that you have your first monitor running, consider:

Add More Monitors: Set up monitoring for all your critical services - web servers, mail servers, databases, LDAP servers, and APIs. See what are monitors for supported protocols.

Create Custom Profiles: Define different alert thresholds for production vs staging environments, or configure private CAs for internal services.

Bulk Import: If you have many services to monitor, use CSV import or the API to create multiple monitors at once.

Deploy Monitoring Agents: For services on private networks, deploy monitoring agents to enable monitoring without exposing services to the public internet.

Review Best Practices: Check out common use cases and best practices for tips on organizing monitors, optimizing alerts, and managing certificates at scale.