# Certificates and domains

How certificate and domain expiry affect checks and incidents.

Expiry signals do not count toward a service's uptime or response time.

## TLS certificates

Every HTTPS check reads the certificate's expiry during its request and gets a separate
signal named `Certificate for <host>`.

| Time left | Certificate signal |
|---|---|
| More than 14 days | Up |
| 14 days or less | Degraded |
| 7 days or less | Down |

One failing result changes the signal. After renewal, recovery needs two successful runs
and three minutes from the first. An expired certificate also fails the HTTPS check.

The check's row and [page](https://docs.kogut.dev/monitoring/checks/#a-checks-page) show the last observed expiry date
in the [server's timezone](https://docs.kogut.dev/reference/configuration/#server). Changing the target
host or port hides it until another run sees a certificate.

Certificates are validated against kogut's bundled Mozilla root store, not the system's,
so private CA certificates fail. TCP checks do not inspect certificates.

## Domain registration

A `domain` check asks the registry for the registration's expiry date through RDAP, not
WHOIS. It needs its own entry; see the
[check reference](https://docs.kogut.dev/reference/configuration/#check).

The target is a registered domain, such as `acme.com` or `acme.co.uk`, not `www.acme.com`.
Internationalised names use punycode, such as `xn--bcher-kva.de`.

| Registration expiry | Check state |
|---|---|
| More than 30 days away | Up |
| 30 days or less | Degraded |
| Expired | Down |
| Not available | Unknown |

One result changes the state, and renewal clears it on the next run. An unknown result
does not open or change an alert. The last known expiry date stays until the target
changes.

Domain checks run on the server once a day, at a fixed time per check, so the first
result can take a day. Each domain can have only one check.

kogut caches IANA's RDAP server list for a day and reads the registry's `expiration`
event, so it needs access to `data.iana.org` and the registry. Missing RDAP support, no
published date, an unreadable response, or a timeout makes the result unknown.

The `.de` and `.eu` registries have no RDAP server, and the `.nl` registry does not
publish expiry dates. Enable auto-renewal at the registrar for these domains.

## Status page behaviour

On the [status page](https://docs.kogut.dev/status-page/), an open expiry incident shows as
degraded performance, without certificate or domain details.