What Our Certificate Checks Look Like in Your Logs
Every certificate check connects to each address behind your monitor, completes a TLS handshake, and reads the certificate chain. Along the way we also record how the service introduces itself, so the report can tell you which application (and, where the server says so, which version) is answering, and point you at the best-practice guide for it. This page describes exactly what that traffic looks like from your side, so nothing in your logs comes as a surprise.
We also note what the TLS handshake itself says about your server's TLS software, and look up the address's reverse DNS name and network owner. Those come from the connection we already make and from public DNS, so they add nothing to your logs.
Where the connections come from
Each check connects once to every address your hostname resolves to (or to the addresses you have configured). Checks from our platform arrive from our published egress addresses; checks run by an internal agent arrive from the agent's own address. The TLS client identifies itself with the SNI name of your monitor.
What we read and send, by protocol
The certificate check itself is passive: it reads the greeting your service sends and completes the handshake. The application fingerprint adds a few standard protocol commands on that same connection after the handshake. None of them log in, send mail, transfer files or change anything.
| Protocol | What we send | What it looks like in your logs |
|---|---|---|
| HTTPS | GET /generatorlabs-fingerprint and GET / | Two access-log lines per address: one 404 for a path that does not exist, then a GET of your home page, of which we read the first 64 KB. No redirect is followed and no linked file (script, stylesheet, image) is fetched. The user agent is GeneratorLabs-CertMonitor (+https://generatorlabs.com). |
| SMTP, SMTP STARTTLS, LMTP | EHLO (LHLO for LMTP), STARTTLS, EHLO, HELP, GENERATORLABS, QUIT | A normal session with no mail transaction. GENERATORLABS is deliberately not a real command, so your server answers with its own wording of "unrecognized command" and may log it that way, as some servers also do for HELP. |
| IMAP, IMAP STARTTLS | CAPABILITY, STARTTLS, CAPABILITY, ID, GENERATORLABS, LOGOUT | A pre-login session. Servers that log client ID strings will record GeneratorLabs-CertMonitor, and the unrecognized GENERATORLABS command may be logged as a bad command. |
| POP3, POP3 STARTTLS | CAPA, STLS, CAPA, GENERATORLABS, QUIT | A pre-login session, with one unrecognized command. |
| FTP, FTP STARTTLS | AUTH TLS, SYST, FEAT, GENERATORLABS, QUIT | A pre-login control-channel session, with one unrecognized command. No data connection is opened. |
| LDAP, LDAP STARTTLS | An anonymous read of the root DSE | What every LDAP client does when it connects. No bind. |
| MySQL, MariaDB | The TLS request of the normal handshake | Nothing beyond an aborted connection before authentication; the version comes from the handshake the server sends first. |
| PostgreSQL | The TLS request only | Nothing is sent after the handshake, so there is no failed connection attempt in the PostgreSQL log. |
| SIP | An OPTIONS request | The standard SIP keepalive; answered with 200 OK and not usually logged. |
Everything the service answers is stored as plain text with the check result, trimmed to printable characters and capped in length. We store cookie names from HTTP responses, never their values, and we never store anything that requires a login to see. From your home page we keep only the title, the generator meta tag and the addresses of its scripts, stylesheets and icons, not the page itself.
Turning the application probes off
If you would rather we only read the certificate and the greeting, open Certificate & TLS Monitoring ➡️ Manage ➡️ Profiles, edit the profile, and turn off Application Fingerprinting. Every monitor on that profile then skips the commands in the table above; the handshake, the greeting your service sends on its own and the DNS lookups are still recorded, since none of them sends anything extra to your server. The report will still identify applications that name themselves in their greeting, but it cannot tell you about versions that are only revealed by the probes.