> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kodostatus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SSL Monitors

> Monitor SSL certificate expiration and get alerts before they expire

SSL monitors track your certificate expiration dates and alert you before they expire, preventing embarrassing and costly outages.

## Why Monitor SSL Certificates?

* Expired certificates cause browser warnings and lost trust
* Many services reject connections to expired certificates
* Auto-renewal can fail silently
* Monitoring gives you time to fix issues

## Creating an SSL Monitor

<Tabs>
  <Tab title="Dashboard">
    1. Go to **Dashboard > SSL**
    2. Click **Add Domain**
    3. Enter the domain to monitor
    4. Set alert threshold (days before expiry)
  </Tab>

  <Tab title="CLI">
    ```bash theme={null}
    kodo ssl add api.example.com --warn 14 --critical 7

    # With custom port and service link
    kodo ssl add api.example.com --port 443 --service SERVICE_ID
    ```
  </Tab>

  <Tab title="API">
    ```bash theme={null}
    curl -X POST "https://kodostatus.com/api/v1/ssl-monitors" \
      -H "X-API-Key: your_api_key" \
      -H "Content-Type: application/json" \
      -d '{
        "hostname": "api.example.com",
        "alert_threshold_warning": 14,
        "alert_threshold_critical": 7
      }'
    ```
  </Tab>
</Tabs>

## What We Check

| Check             | Description                             |
| ----------------- | --------------------------------------- |
| Expiration date   | Days until certificate expires          |
| Certificate chain | All certificates in the chain are valid |
| Domain match      | Certificate matches the domain          |
| Issuer            | Certificate authority information       |

## Alert Thresholds

Configure when to receive alerts:

| Days Before Expiry | Recommended For  |
| ------------------ | ---------------- |
| 30 days            | Standard alert   |
| 14 days            | Urgent reminder  |
| 7 days             | Critical warning |

## Certificate Details

For each monitored domain, we track:

```json theme={null}
{
  "domain": "example.com",
  "expires_at": "2024-06-15T00:00:00Z",
  "days_until_expiry": 45,
  "issuer": "Let's Encrypt",
  "subject": "CN=example.com",
  "valid_from": "2024-03-15T00:00:00Z"
}
```

## Best Practices

<AccordionGroup>
  <Accordion title="Monitor all domains">
    Include subdomains, API endpoints, and any domain serving HTTPS traffic.
  </Accordion>

  <Accordion title="Set multiple thresholds">
    Alert at 30 days for awareness, 14 days for action, 7 days for escalation.
  </Accordion>

  <Accordion title="Monitor wildcard certs">
    If you use `*.example.com`, monitor the base domain.
  </Accordion>

  <Accordion title="Test auto-renewal">
    Even with Let's Encrypt or similar, certificates can fail to renew.
  </Accordion>
</AccordionGroup>