← All posts全部文章

Guide指南Oct 13, 20262026 年 10 月 13 日4 min read阅读约 4 分钟

How to monitor SSL certificate expiry before visitors see a warning如何在访客看到警告之前监控 SSL 证书到期

Get a notice 14, 7, 3 and 1 days before an HTTPS certificate expires, with two ways to set it up and what is checked.在 HTTPS 证书到期前 14、7、3、1 天收到提醒：两种设置方式，以及具体检查了什么。

An expired certificate is one of the most avoidable outages there is. Nothing is broken, the server is fine, the code did not change, and yet every visitor gets a full-page browser warning and API clients refuse to connect. It usually happens because a renewal that used to be automatic quietly stopped, and nobody looked.证书过期是最容易避免的一类故障：服务器没坏，代码没改，访客却看到整页的浏览器警告，API 客户端也拒绝连接。多半是因为原本自动的续期悄悄失效了，而没人去看。

The fix is to be told before it happens. OpenUptime reads the certificate your hostname presents and warns you while there is still time to renew it.解决办法是在事情发生之前就收到通知。OpenUptime 会读取你的域名当前出示的证书，并在还来得及续期的时候提醒你。

Option 1: the certificate check on an HTTPS monitor方式一：HTTPS 监控项自带的证书检查

If you already monitor an https:// URL on the default port 443, there is nothing to set up. The certificate of that host is checked automatically, roughly every six hours, and an expiring certificate sends a notice to the alert channels attached to the monitor.如果你已经在监控某个默认 443 端口的 https:// 地址，就不需要任何设置。该域名的证书会被自动检查（大约每六小时一次），证书即将到期时会向监控项关联的告警渠道发送提醒。

This is deliberately a notice, not an incident. A certificate with nine days left is something to fix this week; it should not turn your uptime history red or page someone at night. When the certificate is renewed you get a "valid again" notice too.这里刻意只是"提醒"，而不是"事件"。证书还剩九天，是本周要处理的事，不该让可用率记录变红，也不该半夜把人叫醒。证书续期之后，你还会收到一条"证书恢复有效"的提醒。

Option 2: a dedicated SSL monitor方式二：专门的 SSL 监控项

For a hostname that has no HTTP monitor of its own, create a monitor of type SSL and enter the hostname, for example example.com. The certificate is read on port 443. Its interval runs from one hour to one day and defaults to six hours.对于没有单独 HTTP 监控的域名，可以创建类型为 SSL 的监控项，填入域名，比如 example.com。证书在 443 端口读取。检测间隔可以是一小时到一天，默认六小时。

An SSL monitor fails, and so opens an incident, when the certificate is within its warning window, has expired, or is not trusted. The error says which: "Certificate expires in 9 days", "Certificate expired on …" or "Certificate is not trusted". Each check uses one check credit.当证书进入提醒窗口、已经过期或不受信任时，SSL 监控项会判定为失败并开启事件。错误信息会说明原因："Certificate expires in 9 days"、"Certificate expired on …"或"Certificate is not trusted"。每次检测消耗一个检测额度。

What gets checked检查的内容

• Expiry date: days left until the leaf certificate's end date.到期日：叶子证书距离到期还剩多少天。
• Trust: whether the chain is trusted. A self-signed or incomplete chain is reported as invalid even when the date is far away.是否受信任：证书链是否可信。自签名或链不完整的证书，即使日期还很远也会被报告为无效。
• Warning window: set per monitor from 1 to 90 days. Notices go out when the window starts and again at 7, 3 and 1 days left, each only once.提醒窗口：每个监控项可设置 1 到 90 天。窗口开始时发送一次提醒，之后在剩余 7 天、3 天、1 天时各提醒一次，每个节点只提醒一次。

Where it is available哪里可用

Certificate checks are part of the hosted service, from the Lite plan upward. They are not available when you self-host on Cloudflare Workers, because the Workers runtime does not expose the certificate of a connection. HTTP, TCP, DNS and heartbeat monitors are not affected by this.证书检查是托管服务的功能，Lite 及以上套餐可用。在 Cloudflare Workers 上自托管时无法使用，因为 Workers 运行时不会暴露连接的证书。HTTP、TCP、DNS 和心跳监控不受影响。

Next to certificates, the other silent failure is a scheduled job that stopped running; monitor cron jobs with a heartbeat covers that. Plan details are on the pricing page.除了证书，另一类悄无声息的故障是定时任务停跑，用心跳监控 cron 任务一文讲的就是它。套餐细节见价格页。