Monitoring
Certificates and domains
How certificate and domain expiry affect checks and incidents.
Expiry signals do not count toward a service’s uptime or response time.
TLS certificates
Every HTTPS check reads the certificate’s expiry during its request and gets a separate
signal named Certificate for <host>.
| Time left | Certificate signal |
|---|---|
| More than 14 days | Up |
| 14 days or less | Degraded |
| 7 days or less | Down |
One failing result changes the signal. After renewal, recovery needs two successful runs and three minutes from the first. An expired certificate also fails the HTTPS check.
The check’s row and page show the last observed expiry date in the server’s timezone. Changing the target host or port hides it until another run sees a certificate.
Certificates are validated against kogut’s bundled Mozilla root store, not the system’s, so private CA certificates fail. TCP checks do not inspect certificates.
Domain registration
A domain check asks the registry for the registration’s expiry date through RDAP, not
WHOIS. It needs its own entry; see the
check reference.
The target is a registered domain, such as acme.com or acme.co.uk, not www.acme.com.
Internationalised names use punycode, such as xn--bcher-kva.de.
| Registration expiry | Check state |
|---|---|
| More than 30 days away | Up |
| 30 days or less | Degraded |
| Expired | Down |
| Not available | Unknown |
One result changes the state, and renewal clears it on the next run. An unknown result does not open or change an alert. The last known expiry date stays until the target changes.
Domain checks run on the server once a day, at a fixed time per check, so the first result can take a day. Each domain can have only one check.
kogut caches IANA’s RDAP server list for a day and reads the registry’s expiration
event, so it needs access to data.iana.org and the registry. Missing RDAP support, no
published date, an unreadable response, or a timeout makes the result unknown.
The .de and .eu registries have no RDAP server, and the .nl registry does not
publish expiry dates. Enable auto-renewal at the registrar for these domains.
Status page behaviour
On the status page, an open expiry incident shows as degraded performance, without certificate or domain details.