Catch SSL expiry before your users do
Atatus SSL checks connect to any host and port, count the days the certificate has left, check the TLS versions it accepts and how fast it answers, from nine locations every minute.
- ✓certificate expires in more than 30 days41 days
- ✓min TLS version is more than or equal 1.21.2
- ✓max TLS version is less than or equal 1.31.3
- ✓response time is less than 300 ms142 ms
Know which cert expires next.
Pick your warning window. Pins inside it fail the check. Renew one and the next run passes.
certificate expires in more than 30 days · got 23 days
Sample data · days until each certificate expires
Set the range. Find the old protocol.
Assert a minimum and a maximum TLS version, and see which hosts fall outside it.
- api.example.com:443passaccepts TLS 1.2 to 1.3
- www.example.com:443passaccepts TLS 1.2 to 1.3
- admin.example.com:443passaccepts TLS 1.3
- mail.example.com:465failaccepts TLS 1.0, below 1.2
- legacy-api.example.com:8443failaccepts TLS 1.0, below 1.2
Supported versions per host are sample data
Internal hosts count too.
Check mail, LDAP and build servers on their own ports. Allow self-signed certificates where you trust them.
- SSL checkfailing
- Host
- build.example.com
- Port
- 8443
- Certificate
- self-signed
Supports self-signed certificatesFails: the certificate is self-signed. Turn the option on for internal hosts you trust.
- SSL checkfailing
- Host
- ldap.example.com
- Port
- 636
- Certificate
- self-signed
Supports self-signed certificatesFails: the certificate is self-signed. Turn the option on for internal hosts you trust.
- SSL checkpassing
- Host
- imap.example.com
- Port
- 993
- Certificate
- issued by a public CA
Supports self-signed certificatesExpires in 64 days · TLS 1.3
Each check runs from the locations you pick, every minute by default, and alerts email, Slack, PagerDuty, Microsoft Teams or a webhook.
See every check typeQuestions about SSL monitoring
Pricing, deployment, data and the agent. If something is missing, a person will answer it on a demo call.
SSL certificate monitoring keeps checking the certificates on your hosts, so an expired or misconfigured one never reaches your users. An Atatus SSL check connects to a host and port, then checks how many days the certificate has left, which TLS versions the server accepts and how long the connection takes. It runs every minute by default, from the locations you pick.
Add the assertion “certificate expires in more than” a number of days, for example 30. Once fewer days are left, the check fails, and when your retry and location conditions are met an alert goes to email, Slack, Microsoft Teams, PagerDuty, OpsGenie, SMS through Twilio or a webhook. Pick a window that leaves your team enough time to renew.
Yes, as long as the host is reachable from the Atatus check locations. Allow the published Atatus IP addresses through your firewall, then set the host and port, such as an LDAP or mail server on its own port. If the service uses a self-signed certificate, turn on “Supports self-signed certificates” for that check.
A certificate that expires within the number of days you set, or has already expired. A server that accepts a TLS version below your minimum or above your maximum. A connection slower than your response time limit. And a self-signed certificate on a check where you have not allowed one.