Understanding Certificate Reports
Every monitor has its own page, with its reports, its history and its settings. Open it by clicking the monitor's name in Certificate & TLS Monitoring ➡️ Manage ➡️ Monitors. The page has five tabs:
| Tab | What it shows |
|---|---|
| Summary | The monitor at a glance. The page opens on this tab. |
| Certificate Report | The full certificate check: findings, checks and the certificate chain. |
| TLS Report | How the server handles TLS. Certificate & TLS Monitoring is coming soon. |
| History | Every change to the certificate, and every period an issue lasted. |
| Settings | The monitor's name, monitoring, profile, contact groups and tags. |
A new monitor shows Pending First Check until its first check runs, shortly after it's added; the page shows the result as soon as it arrives.
Summary
The Summary tab leads with the monitor's overall state, its host, and its SID with a copy button (use the SID with the API).
The Software card names the server software the host runs (such as nginx, Postfix or Microsoft Exchange) and its version when the server shows one, along with the edge in front of it (a CDN or load balancer) and where it's hosted. If we got it wrong, or couldn't tell, click Is This Right? (or Tell Us What It Runs) to confirm our match, pick the right product, or name one that isn't on our list; we use your answer until the server states its own product and version. The TLS Configuration Guide link opens a guide to setting up TLS on that software. Identification can be turned off on the monitor's profile (Application Fingerprinting); see what our checks look like in your logs for what it sends.
The Certificate card shows the certificate's state and days left, when it expires, its issuer and key, and its findings by severity. Click the card to open the Certificate Report. The TLS card beside it is a placeholder until Certificate & TLS Monitoring is available.
Certificate Report
The Certificate Report tab (#certificate on the page's address) is the full result of a check.
The Top Card
The top card shows the certificate's state, its days left and how much of its lifetime is used, and under the days left its validation level: Domain Validated, Individual Validated, Organization Validated or Extended Validation, which says how much the certificate authority verified about who requested it. Beside it are the certificate's issuer, its key, and the number of addresses the hostname resolved to.
The top card also counts what the Findings card holds by severity, such as "1 error", "2 warnings" or "3 suggestions" (or Nothing to fix); click a count to jump to the findings.
Findings
The Findings card lists every problem the check found, worst first. Each finding shows:
- its title (for example Certificate revoked by its CA) and its key (such as
CERT_REV01) - what it means
- what the check found, highlighted (for example Doesn't cover www.example.com, or the addresses a connection failure happened on)
- How to Fix It, linking to the finding's page in Certificate Findings
Suggestions, and No CAA record, can be dismissed on the monitor with the × beside them. See dismissing a finding. The card only shows when it has something in it.
Checks
The Checks card lists each check: Passed when it found nothing, or the short labels of what it found:
| Check | What it can find |
|---|---|
| Connection | Network Failure, Network Timeout, STARTTLS Failure, SSL Failure, DNS Failure, Private IP Blocked, Connection Rejected, Certificate Not Read |
| Expiration | Expires Soon, Expired, Invalid Expiration Dates |
| Validity period | Long Reg Period |
| Hostname | Matched CN, No SAN, Name Does Not Match |
| Chain of trust | Not Trusted, Root Sent |
| Revocation | Revoked |
| Signature algorithm | Unknown Sig Algorithm, Weak Sig Algorithm, Insecure Sig Algorithm |
| Key strength | Weak Key Algorithm, Legacy Key Algorithm |
| CAA | CAA Not Found, CAA Not Specific, CAA Record Failure, CAA Critical Tag, CAA Lookup Failed, CAA Forbids All Issuers, CAA Record Malformed |
| Consistency | Certs Did Not Match |
When the check can't get a certificate, only the reason is a finding, and the checks that need a certificate show Not checked, with the addresses they couldn't run on. The CAA check only needs DNS, so it still runs; it doesn't apply to a monitor whose hostname is an IP address. A dismissed finding shows here as information, marked (dismissed), with Restore beside it.
:::info SAN vs. Common Name For HTTPS monitors the hostname must appear in the certificate's Subject Alternative Names; the Common Name is ignored, exactly as modern web browsers behave. For other protocols (mail, FTP, LDAP, database, SIP), whose clients still honor the Common Name, a certificate with no SAN will match on the CN but is flagged Matched CN, No SAN so you know to reissue it with a SAN. :::
The Certificate Chain
The chain is drawn from the Server certificate through any Intermediate certificates to the CA that it's trusted to, either a root in the public trust store or one of your private CAs. Click a certificate to open it. Each one shows its alternative names, validity dates, key and signature algorithm, subject, issuer, serial number and fingerprint (with copy buttons), and its checks in plain words, one line per check that applies to it: for example Not expired: 126 days left, Covers example.com or Trusted (DigiCert Global Root G2). A check that found something shows the finding's key, which links to it on the Findings card.
When the server sends its root certificate along with the chain, the root is shown once, as the CA, marked Also sent by the server, and the Root certificate sent in the chain suggestion is on the Findings card.
Addresses
When the hostname resolves to more than one address, click the Addresses count in the top card to see each address the check connected to. Addresses that served the same certificate are shown together, with a warning when they served different ones; a connection finding names the addresses it happened on.
Moving Between Checks
The card above the checks shows whether you're looking at the latest check or an earlier one, with buttons to step to the previous and next checks and Go to Latest. The report loads in place, and the browser's back and forward buttons step through the checks you've viewed. While you're on the latest check, a newer check replaces the report when it lands.
History
The History tab starts with the last 90 days as a strip, one square per day shaded by the share of that day's checks with errors; a day with a recorded change is marked with a folded corner. Click a day to select its change or the issue covering it.
Below it, the change history lists, newest first:
- certificate changes: a renewal, a replacement, a certificate added or removed, a changed chain, or the domain's CAA record added, removed or changed
- issue periods: how long each warning or error lasted, or Ongoing for one that hasn't been resolved
- runs of certificate flapping
- software changes: a different product or version on the server
- the monitor's first check, where its history starts
Select an entry to see what changed, with a link to that check's full report. An ongoing issue shows its findings the same way the reports do: what each means, what the latest check found, and how to fix it. The number on the History tab counts the ongoing issues, in red when one is an error and orange when the worst is a warning.
Settings
The Settings tab shows the monitor's SID and host, and lets you change its Display Name, Monitoring, Profile, Contact Group(s) and Tags. See adding a new monitor for what each field does.
Report Actions
| Action | What it does |
|---|---|
| Check Now | Runs a check right away and shows the result when it's done. It counts toward the monitor's daily charge like any other check: a monitor is charged at most once a day. |
| Share Report | Opens the share dialog: copy a short link to this check's report, or send it to your contacts with an optional note. Other email addresses receive the link without the note. |
| Export Report | Downloads the report as a PDF: the top card, the findings, each certificate and its chain, and the addresses when there's more than one. Times and dates in the PDF are in UTC, and labelled UTC. |
Dates and times on the monitor's page are shown in your own time zone.
Shared Reports
A shared report link opens a public copy of that check's Certificate Report, with the same top card, findings, checks and chain, but without the actions or the history. Dismissed findings are left out. Its dates and times are in UTC, labelled UTC, since the viewer may not have an account; a team member who is logged in sees the report in their own time zone instead.