What Are Certificate Monitors?
A Certificate Monitor is a configured endpoint that Generator Labs continuously checks for TLS/SSL certificate validity and expiration. Each monitor represents a specific service or server that uses certificates for secure communication.
When you create a monitor, you specify a hostname or IP address, a protocol that defines how the TLS/SSL connection is established, a profile that determines validation rules and alert thresholds, and contact groups to notify when issues are detected. The system regularly connects to your service, retrieves the certificate chain, validates it, and alerts you of any issues.
Supported Protocols
Generator Labs supports certificate monitoring for the following protocols:
Web Services
- HTTPS (port 443)
Email Services
- SMTPS (port 465)
- SMTP + STARTTLS (port 25)
- IMAPS (port 993)
- IMAP + STARTTLS (port 143)
- POP3S (port 995)
- POP3 + STARTTLS (port 110)
- LMTP + STARTTLS (port 24)
File Transfer
- FTPS (port 990)
- FTP + STARTTLS (port 21)
Directory Services
- LDAPS (port 636)
- LDAP + STARTTLS (port 389)
Database Services
- MySQL (port 3306)
- PostgreSQL (port 5432)
Voice/SIP
- SIPS (port 5061)
STARTTLS vs Implicit TLS
Services with implicit TLS like HTTPS and SMTPS establish an encrypted connection immediately upon connecting. Services using STARTTLS like SMTP on port 25 begin with an unencrypted connection, then issue the STARTTLS command to upgrade to TLS/SSL before retrieving and validating the certificate. This approach provides backward compatibility with older clients that don't support encryption.
Hostname Configuration
Monitors support DNS hostnames like mail.example.com where the system performs A and AAAA record lookups and monitors each IP address returned, making it ideal for load-balanced services. You can also directly specify IPv4 addresses like 203.0.113.10 or IPv6 addresses in square brackets like [2001:db8::1].
Override the default port by appending a colon and port number, for example mail.example.com:2500 for SMTP on a custom port, 203.0.113.10:8443 for HTTPS on port 8443, or ldap.example.com:10636 for LDAPS on a custom port.
A hostname checked from our system has to include its domain and resolve to public addresses; internal names and private addresses are monitored through a monitoring agent. See adding a new monitor for the rules.
Monitor Management
Each monitor has its own page, opened by clicking its name in Certificate & TLS Monitoring ➡️ Manage ➡️ Monitors. The page has a Summary, the full Certificate Report, a TLS Report (Certificate & TLS Monitoring is coming soon), the monitor's History and its Settings; see understanding certificate reports. Each monitor also has a unique system identifier (SID), shown on its page, and optional tags for organizing and filtering. Monitors run checks on a regular schedule, and send alerts to their contact groups when issues arise.
Use descriptive display names that identify the service purpose, environment, and location. Apply tags to group related monitors and select the appropriate profile for your service type. Adjust alert thresholds based on your certificate renewal lead times.
Monitor Status
| Status | What it means |
|---|---|
| Active | The monitor is checked on schedule and billed daily. |
| Paused | The monitor isn't checked or billed until you resume it. |
| Archived | The monitor isn't checked or billed, and is hidden from the monitors list unless you filter for it. Its reports, history and health calendar days stay available, and you can resume it at any time. |
Use the action toolbar on the monitors list to Pause, Resume or Archive monitors. Only an archived monitor can be deleted, and deleting it removes its reports and history for good. Archived monitors don't count toward your monitor limit, and don't stop you adding the same host again.
Free Monitor
Every account gets one HTTPS monitor free, forever. Monitors on other protocols are never free. See how billing works.