SSL and domain monitors
Why an SSL monitor goes degraded before it goes down, what a hostname mismatch means, and why a domain check can't always read an expiry date.
SSL and domain monitors both watch something that expires, so they share a pattern: degraded as a warning while there's still time, down once it's actually a problem. Here's how to read each.
SSL: degraded before it's expired, down once it is
Why it happens. An SSL monitor connects over TLS, reads the certificate, and classifies it:
- Degraded — the certificate is still valid but within the expiry threshold (14 days before expiry by default). This is your early warning to renew, not an outage.
- Down — the certificate has actually expired, the hostname doesn't match the certificate, the chain fails to validate, or it's self-signed (unless you've allowed that). It also goes down if the TLS connection itself fails — a timeout, a refused connection, or DNS not resolving.
How to fix.
- Degraded near expiry — renew the certificate. Once the new one is in place with more days remaining than the threshold, the monitor returns to up on its next check. You can also adjust the threshold on the monitor if you want more or less lead time.
- Hostname mismatch — the certificate doesn't cover the host you're checking. Confirm the cert's SANs (or CN) include that exact hostname. A wildcard like
*.example.comcoversapp.example.combut not the bareexample.com, and not a deepera.b.example.com. - Chain validation failed — the server is likely missing an intermediate certificate. Install the full chain, not just the leaf.
Checking an internal or self-signed cert?
By default a self-signed certificate is treated as down. If that's expected for the host, enable the monitor's allow-self-signed option so it's evaluated on expiry instead.
Domain: expiry from an RDAP lookup
Why it happens. A domain monitor reads your registration's expiry date from an RDAP lookup (the modern successor to WHOIS). A few situations are worth knowing:
- Some TLDs don't publish an expiry date over RDAP. When no expiry is available, the monitor can't warn you before it lapses — it simply reports up rather than inventing a date.
- A degraded status means the domain is valid but within the expiry threshold (30 days by default) — time to renew.
- A down status means the registration has genuinely expired, the domain wasn't found, or the RDAP lookup didn't succeed.
How to fix.
- Renewing — once the registration is extended past the threshold, the monitor returns to up on its next check.
- Down right after setup — double-check you're watching the registrable domain (
example.com), not a subdomain, which RDAP won't have a record for.
A transient RDAP failure can read as down
If the RDAP service is briefly unreachable or rate-limits the lookup, that check is recorded as down rather than silently assumed healthy. A one-off blip is smoothed over by the failure threshold — it takes several consecutive failures to alert — so a momentary RDAP hiccup won't page you.