Certificate monitoring
Every certificate hostnag can reach is watched for expiry and a swapped chain; the ones it cannot reach get a URL to report to instead.
Included on every plan.
| What breaks | hostnag |
|---|---|
| A certificate expiresdays-before thresholds, daily inside the last window | Yes |
| A certificate is swappedfingerprint changed, wrong host, chain not trusted | Yes |
How it works
- 01
Add the host
A hostname or IP and, optionally, a port. hostnag connects with direct TLS by default, or upgrades a plain connection first with STARTTLS for SMTP, IMAP, POP3 or PostgreSQL.
- 02
Set the thresholds
Days-before-expiry thresholds default to 30, 14, 7, 3 and 1; the last window repeats daily so a certificate close to expiring never falls out of view.
- 03
hostnag watches the chain, not just the date
A changed fingerprint, a hostname the certificate does not cover, or a chain that no longer validates: each raises its own event, separate from a plain expiry warning.
- 04
Or report one hostnag cannot fetch
Paste or POST a certificate (PEM or DER, capped at 64 KB) to a minted URL for private PKI, client, code-signing or S/MIME certificates. It is parsed once and judged daily.
What you'll be told
What you get told
- Cert
[Critical] api.example.com certificate expires in 2 days
The certificate for api.example.com expires in 2 days (14 Sept 2026). Renew it before then.
- Cert
[Warning] Certificate issuer changed on api.example.com
The certificate on api.example.com is now issued by ZeroSSL RSA Domain Secure Site CA (was Let's Encrypt (R11)). A renewal by a new CA is normal; anything else is worth a look.
- Cert
[Critical] Certificate on api.example.com is not valid for this host
api.example.com serves a certificate that does not cover this hostname. Browsers will warn visitors.
Sample alerts, rendered by the same code that writes your email and Slack messages.
Settings
- Target
- a hostname or IP, direct TLS or STARTTLS for SMTP, IMAP, POP3, PostgreSQL
- SNI
- an optional override for virtual hosting
- Timeout
- 30s
- Interval
- 1440 min on Free, 60 on Pro, 15 on Business
- Thresholds
- 30, 14, 7, 3, 1 days by default, set per group
- Reported certificates
- PEM or DER, capped at 64 KB, judged daily, every plan
Questions
Do you need my private key?
No. Only the certificate itself, which is public by design, whether hostnag fetches it or you report it.
What counts as a certificate being swapped?
A changed fingerprint, a hostname the certificate does not cover, or a chain that no longer validates. Each is its own alert.
Can I watch a certificate hostnag can't reach from outside?
Yes. Paste or POST it to a minted report URL; it is judged daily without ever being resolved over the network.
Related
Add a host. Hear about it first.
Start free