Check SSL certificates, domains and DNS

Every uptime monitor also checks the SSL certificate, domain registration and DNS records of its URL. The team gets an alert before a certificate or domain expires, when a certificate becomes invalid and when DNS records change.

Requirements

An uptime monitor. The three checks are on by default.
For the certificate check, an https:// URL.

Turn checks on or off

Open the monitor's page from Uptime.
Under Certificate, domain & DNS, tick or untick SSL certificate, Domain expiry and DNS changes.
Optional: tick Also A, AAAA and CNAME records.
Click Save.

In the API: the check_ssl, check_domain, check_dns and dns_addresses fields of updateMonitor.

Check that it works

The Health row on the monitor's page has the tiles SSL, Domain and DNS, each Pending until its first check, within a minute. The cards below show the certificate, the domain's expiry date, and the DNS records with Recent changes.

The monitor list shows a badge when a certificate is invalid (SSL invalid) or expires within 14 days (SSL 9d), or a domain expires within 30 days (Domain 21d).

SSL certificate


How often	Every 6 to 12 hours, and within a minute after a new monitor or a new host.
What it reads	Expiry date, issuer, names, and whether the certificate is valid for the host (Mozilla's root certificates).
Expiry alerts	14, 7, 3 and 1 days before it expires, each once per certificate.
Invalid alert	When it expires, names the wrong host or has an unknown issuer. Once, until it is valid again.

A failed connection gives no certificate alert; the uptime check reports it. When a check fails because of the certificate, the monitor's down alert says why and no separate certificate alert is sent.

Domain expiry

Lampwick looks up the registrable domain of the URL once a day through RDAP, at the registry's server from the IANA bootstrap file. For shop.example.com that is example.com, for x.github.io it is github.io. Monitors on one domain share one lookup.


Expiry alerts	30, 14, 7 and 1 days before the registration expires, once per threshold, expiry date and project.
Registry without an expiry date	Some registries, including `.nl`, publish no expiry date or have no RDAP server. The tile says Unknown, no alerts are sent, and Lampwick tries again weekly.
Failed lookups	Retried after 1, 2, 4 … hours, at most a day apart.

A URL with an IP address or an unknown suffix has no registrable domain; the tile says None.

DNS changes


How often	Hourly.
Records	NS and MX of the host and its domain. With Also A, AAAA and CNAME records, those too.
Resolvers	Public resolvers (Cloudflare and Google), never your server's own.
Confirmation	A difference is looked up again after 5 minutes. Only when the second lookup agrees does the change go into Recent changes and alert.
Alert	DNS records changed: HOST, listing the added and removed records.

A, AAAA and CNAME are off by default because CDNs and load balancers rotate them.

Paused and muted monitors

A paused monitor gets no host checks. With Mute alerts for everyone, the checks run but no one gets alerts.

Troubleshooting

What you see	Cause and fix
SSL: None, "Only https URLs have a certificate"	The monitor's URL is `http://`. Change it to `https://` to check the certificate.
SSL: Unknown, "Could not read it: …"	The handshake failed. The uptime check shows whether the site is reachable.
Domain: Unknown, "the .nl registry doesn't publish expiry dates"	Lampwick can't warn you before expiry. Turn on auto-renew at your registrar.
Domain: Unknown, "the lookup failed; Lampwick retries it"	The RDAP server didn't answer or returned an error. Lampwick retries, at most a day apart.
DNS: None	The URL is an IP address, or a name that public DNS can't resolve, such as `localhost` or `*.internal`.
Frequent DNS records changed alerts	Your CDN or load balancer rotates the A, AAAA or CNAME records. Untick Also A, AAAA and CNAME records.

To find broken links on the same site, turn on the site crawl.