How-to
Certificate Monitoring
Add domains to monitor for SSL/TLS certificate expiry, changes, and health. Live checks every six hours, with confidence-aware change alerts.
Jump to section
What it does
Certificate monitoring tracks the SSL/TLS certificates on your domains. Edge checks every monitored domain every six hours (you can also trigger a manual check from the certificate detail page at any time) and alerts when:
- A certificate is approaching expiry (configurable thresholds: 30, 14, 7, 1 days)
- A certificate changes issuer unexpectedly
- A domain stops serving a valid certificate
Renewals from the same certificate authority are logged on the certificate's timeline as routine events; they do not raise an alarm.
How to use it
- Navigate to Certificates in the sidebar
- Click Add domain and enter the domain name (e.g.
www.example.com) - Edge checks the domain straight away and shows the certificate details
- The detail page shows: issuer, certificate authority, signature algorithm, SANs, validity dates, fingerprint, minimum TLS version, and how the reading was obtained
How Edge reads your certificates
Edge prefers a live reading: connecting to the domain and inspecting the certificate it actually serves, or reading the authoritative record where Edge manages the domain. When a live reading is not possible (some CDN configurations do not expose the served certificate to an outside probe), Edge falls back to public Certificate Transparency logs, which record every certificate publicly issued for a name.
That distinction matters for change alerts. Transparency logs list every certificate issued across your whole estate, including subdomains and infrastructure that is not your storefront, so a new entry there does not prove the certificate your shoppers see has changed.
Change alerts are confidence-aware
- Issuer changed, both readings live — a critical alert with notifications. Two direct observations disagreeing means the certificate serving your domain really did change issuer.
- Issuer changed, but either reading came from transparency logs — recorded as an informational alert with a note explaining the lower confidence. It appears in the product for review but does not page you.
This stops routine noise (a new certificate issued for a subdomain, a parallel certificate on other infrastructure) from waking anyone up, while a genuine unexpected issuer change on your live storefront still does.
Expiry alert thresholds
| Days remaining | Severity |
|---|---|
| 1 day or less | Critical |
| 7 days or less | Warning |
| 14 days or less | Info |
| 30 days or less | Info |
Status badges
| Status | Meaning |
|---|---|
| Valid (green) | Certificate is valid and expiry is more than 30 days away |
| Expiring (amber) | Certificate expires within 30 days |
| Expired (red) | Certificate has expired |
| Pending (grey) | Domain added but not yet checked |
| Not found (amber) | No certificate could be confirmed (private, misspelled, or unreachable domain) |
Notification routing
Each certificate can have its own notification routing (email and/or webhook), set on the certificate detail page under "Notification routing". If not set, alerts fall back to the certificate rule's routing, then to your tenant defaults from Settings.
Limitations
- Chain validation is not yet available. Edge reports on the leaf certificate, not the full chain.
- Private certificates (self-signed or internal CA) that never appear in public logs can only be monitored where a live reading is possible.