SSL Cert Watch

Daily check of SSL certificate expiration dates for a list of domains. Notifies when any cert is within the configured renewal window (default 30 days) or has already expired.

What it does

The monitor's check runs a bash one-liner that hits each domain on port 443 via openssl s_client, parses the notAfter date, and computes days remaining. Per-domain status lines are tagged OK or ALERT. A summary line emits ALERT when at least one domain is in trouble.

The when: arm uses contains ALERT to gate notification — quiet on healthy days, single alert email on the day something needs attention.

Edit before installing

In monitor.yaml:

• The DOMAINS=(...) array — list every domain:port pair you want to watch.
• THRESHOLD_DAYS=30 — renewal window. Lower (e.g. 14) for aggressive monitoring, higher (e.g. 60) for slow renewal workflows.
• Schedule daily — running this more often wastes openssl handshakes and spams alerts on persistent issues.

Bindings used

• {{check.output}} — full bash output: per-domain status lines + summary.

Tools used

• runtimeenv — core InTouch task type, executes the inline bash script. Requires openssl on the runtime environment's PATH (standard on Linux/Mac/Git Bash).

Previous form

Replaces the ssl-cert-expiration job (deleted 2026-05-19). Same logic; the monitor variant uses the standard quiet-by-default pattern instead of always sending a digest.