SSL
How Telescope monitors SSL certificates for expiration, validity, and configuration issues.
SSL monitors connect to your server via TLS and inspect the certificate to detect expiration, hostname mismatches, self-signed certs, and chain issues.
How a check works
- Telescope opens a TLS connection to the target hostname and port.
- The TLS handshake time is measured as the response time.
- The server's certificate is extracted and parsed for subject, issuer, validity dates, SANs, and chain info.
- Status is determined based on expiry, hostname match, chain validity, and self-signed state.
- The result is recorded and your monitor's status is updated.
Checks never hang — every connection has a timeout (default 30 seconds, configurable per monitor). If the TLS handshake doesn't complete in time, the check is marked as down.
Status classification
| Condition | Status | What it means |
|---|---|---|
| Valid cert, days remaining > threshold | Up | Certificate is healthy |
| Cert expires within threshold (default 14d) | Degraded | Certificate expiring soon |
| Cert expired | Down | Certificate has expired |
| Hostname mismatch | Down | Cert doesn't match monitored hostname |
| Self-signed (not allowed) | Down | Untrusted certificate |
| Chain validation failed | Down | Incomplete or invalid cert chain |
| Connection failed | Down | Server unreachable |
Certificate details collected
Every check records full certificate metadata:
- Subject and issuer (CN, organization)
- Validity dates and days remaining
- Serial number and SHA-256 fingerprint
- Subject Alternative Names (SAN list)
- TLS protocol version (e.g. TLSv1.3)
- Key algorithm (RSA, ECDSA) and size
- Self-signed detection
- Chain validity and depth
Configuration options
| Setting | Default | Description |
|---|---|---|
| Expiry threshold | 14 days | Days before expiry to mark as degraded |
| Allow self-signed | No | Whether to accept self-signed certificates |
| Port | 443 | TLS port to connect to |
| Timeout | 30 seconds | How long to wait for TLS handshake |