SSL Cert Monitor

Configure an isolated daily schedule or external monitor for this checklist; copying it does not install a schedule. Use an approved TLS-capable command runner, not web_fetch alone.

1. For each explicit public hostname and port, connect to the serving endpoint using that hostname as SNI. Read the presented leaf certificate's notAfter and identify the endpoint/time checked. Check hostname match and chain trust separately. If the probe cannot run or the handshake fails, mark the result unknown or failed; never report a healthy certificate from a failed read.
2. Record expiry in UTC and the last verified certificate identity. Alert on crossing your chosen 30-, 14-, 7-, and 3-day thresholds, or on a verification failure. Make notifications idempotent per hostname and threshold; re-alert only according to your incident policy.
3. After an apparent renewal, recheck the served endpoint before reporting recovery. A renewed local file or successful ACME job does not establish that the public endpoint serves it.
4. Send a concise report with hostname, observation time, expiry, verification outcome, and any probe error. Never renew certificates or change DNS as part of this monitoring checklist.

Test one expiring-certificate fixture and one unreachable endpoint before trusting alert delivery. Without shell or an equivalent TLS monitoring API, stop and report the missing capability.