Certificate Monitoring

Certificate Monitoring tracks SSL/TLS certificate status and expiration for configured HTTPS endpoints so operations teams can catch expiration, trust, and hostname coverage issues before browser warnings, failed checks, or service outages affect users.

When To Use It

• Use Certificate Monitoring for HTTPS endpoints where certificate expiration or certificate status changes could interrupt access.
• Use Endpoint Monitoring to track whether the same URL is available, responsive, and meeting uptime expectations.
• Use DNS Monitoring and Domain Monitoring when the risk is record resolution, nameserver behavior, or domain status rather than the certificate itself.

Prerequisites

• A Bitaic account with permission to configure monitored targets.
• One or more HTTPS endpoint URLs to monitor.
• Endpoint target and collection access for the URL when Certificate Monitoring shares monitoring plumbing with Endpoint Monitoring.
• A certificate alert window for each URL: omit ssl_alert_days to use the 30-day default, or set an integer from 1 through 365 days.

What Bitaic Checks

• Endpoint URL for the monitored HTTPS target.
• Current SSL/TLS certificate status.
• Certificate expiration date or days remaining.
• Certificate-chain health against the platform trust store.
• Hostname coverage for the monitored URL.
• Issuer metadata for dashboard, CLI, API, and troubleshooting use.
• Negotiated TLS protocol and cipher-suite diagnostics when available.
• Configured alert threshold in days.
• Monitoring state and recent certificate check results.

Configuration Example

endpoint-agent-config.yml
endpoints:
  - url: https://your-domain.com
    ssl_alert_days: 30
  - url: https://another-endpoint.com
    ssl_alert_days: 15

Setup Flow

1. Add the HTTPS endpoint URL to the monitored endpoint list.
2. Use the default 30-day ssl_alert_days window, or set an integer from 1 through 365 days before expiration when Bitaic alerts.
3. Start or refresh the endpoint monitoring collection path so the certificate check is picked up.
4. Confirm that the endpoint appears in the certificate dashboard with a certificate status, expiration date, days remaining, and alert state.

Example Workflow: Monitor a Production Certificate

Goal: add an HTTPS endpoint to Certificate Monitoring, route renewal alerts, and confirm the certificate is ready for routine operations review.

1. Choose the production HTTPS URL and confirm the owning team knows who can renew or replace its certificate.
2. Add the URL to endpoint-agent-config.yml and set ssl_alert_days to the renewal window your team uses for certificate work, or omit it to use the 30-day default.
3. Start or refresh the endpoint monitoring collection path so Bitaic can read the certificate chain presented by the endpoint.
4. Open the certificate dashboard and confirm the endpoint has a current certificate status, chain and hostname results, expiration value, days remaining, and alert state.
5. Attach the endpoint to the alert policy that reaches the team responsible for certificate renewal.
6. During normal operations, review expiring certificates, renew through the certificate owner or hosting provider, then confirm Bitaic shows the updated expiration date.

Data, Alerts, And Dashboard Output

Bitaic alerts when a certificate is approaching expiration, cannot be trusted through the presented chain, or does not cover the monitored hostname. Expiration alerts use the configured threshold, including the default 30-day window when no explicit value is set. Alert routing uses the same notification and incident integrations as the rest of the Bitaic monitoring platform.

Renewal Workflow

1. Use the dashboard alert to identify the endpoint, expiration date, and remaining renewal window.
2. Renew or replace the certificate through the owning certificate or hosting provider.
3. Re-run or wait for the next Certificate Monitoring check after the renewed certificate is deployed.
4. Confirm that Bitaic shows the updated expiration date and clears the expiration alert state.

CLI And API

CLI support covers listing configured certificate checks, retrieving the latest certificate status for a monitored HTTPS endpoint, and running a manual certificate check.

bitaic ssl list
bitaic ssl status <url>
bitaic ssl check <url>

SSL CLI output includes url, certificate_status, expires_at, days_remaining, ssl_alert_days, chain_status, hostname_status, issuer, tls_protocol, cipher_suite, alert_state, and checked_at. Certificate threshold changes remain managed through configuration or API workflows, and invalid threshold values fail validation instead of falling back to the default.

• Create the monitored HTTPS endpoint with /v1/workspaces/{workspace_id}/targets and type: "endpoint".
• Attach certificate monitoring with /v1/workspaces/{workspace_id}/targets/{target_id}/checks and type: "ssl_certificate".
• Retrieve expiration data with /v1/workspaces/{workspace_id}/metrics and metric=ssl.days_remaining.
• Retrieve chain, hostname, issuer, protocol, and cipher diagnostics from the ssl_certificate check status.
• Update ssl_alert_days on the ssl_certificate check with /v1/workspaces/{workspace_id}/checks/{check_id}.

Troubleshooting