Checking SSL Certificate Status

Overview

Plenix doesn't just read a certificate's expiry date — it makes a live TLS connection to each domain, checks the whole chain, and grades what it finds the way a browser would judge it.

1. Go to Monitoring → SSL Certificates.
2. The table shows each domain, its grade, expiry date, and days remaining.
3. Certificates known from a monitored device or company are picked up automatically — look for the Auto-discovered tag and its source.
4. To add one yourself, click Add Certificate and it's checked immediately (Add & check now).
5. Click a row to see full certificate details (issuer, SANs, chain, TLS version, key strength), or click Re-check now to probe it again on demand.

How grading works

Every certificate is scored A+ down to F, deliberately harsh at the bottom: anything that would interrupt a visitor in their browser is an F, no matter how modern the rest of the setup is.

Grade	When it's given
F	Unreachable, expired, self-signed, an invalid chain, a SHA-1/MD5 signature, or an RSA key under 2048 bits
D	Still on TLS 1.0, 1.1, or plain SSL
C	7 days or fewer until expiry
B	30 days or fewer until expiry, or a sound cert not yet on TLS 1.3
A	TLS 1.2, healthy chain, expiry not imminent
A+	TLS 1.3, healthy chain, expiry not imminent

An automatic sweep re-probes every certificate nightly, so a grade or an expiry countdown never goes stale between visits to the page.

Alerts

Certificates expiring within 30 days show an amber warning; within 7 days show red. Configure expiry alerts under an alert template using the ssl_days_remaining metric to receive email warnings ahead of either threshold.

Where to go next

• Understand the whole module → How Device Monitoring Works
• Next in this module → View Patch Status
• How to Use Software Inventory & Automated Patch Management
• How to Manage IP Addresses (IPAM)
• See where this fits in the bigger picture → How a Device Problem Becomes a Fix