When does a domain's certificate expire, who issued it, and is the chain valid? One check from our hub in Belgium, no account. For your whole server estate in one view: the guide below, or monsys itself.
We store only the domain and the time, for 24 hours, for rate limiting. No cookies, no tracking.
Internal APIs, mail servers, a customer's reverse proxy: expired certificates are rarely on the domain you happen to check. The guide shows how to inventory every certificate on every port of every host and alert 14 days ahead — with nothing but openssl and cron.
Or let monsys do it: uptime checks read the chain and alert at 14 days, the agent inventories every certificate on the host.
Usually an intermediate certificate is missing on the server. Browsers often fetch it themselves (AIA fetching); curl, apps and monitoring tools don't. Add the full chain (fullchain.pem) to your web server config.
The certificate the CDN shows to visitors. You don't see the certificate on your origin server here; check that separately, for instance with the script from the guide.
The endpoint is /api/tls-check?host=<domain> and returns JSON, limited to 20 checks per minute. For continuous monitoring of several domains, the uptime checks in monsys are the intended tool.
Guides that solve everything by hand first, and only then show what monsys automates.