checkfleet

TLS certificates check

certs — TLS certificates

Certificate expiry for explicit targets and every host of an Ansible inventory, with WARN/BAD day thresholds.

checkfleet check certs --config checkfleet.yml

TLS certificate expiry across a fleet.

  • Dials each target with SNI and reads the leaf certificate’s NotAfter.
  • Reports OK, WARN (expires within warn_days), or BAD (within crit_days or already expired).
  • A dial/handshake failure is ERROR (couldn’t measure), not BAD.
  • Targets come from the explicit targets list and/or every host of an Ansible INI inventory (ansible_inventory). Probes run concurrently.

The dial uses InsecureSkipVerify on purpose: we want the expiry date even when the chain doesn’t validate locally. It is an expiry reader, not a chain validator.

See Configuration → checks.certs.

See the full module reference for every check, or configuration for the config keys.