Let’s talk
← All insights
ENGINEERING JOURNAL / Observability Operations

Blackbox TLS checks: monitor failure and certificate age

Monitor the certificate presented on the real network path while detecting failed probes and missing expiry samples as separate operational signals.

Clouvenix Engineering notes · 4 min read · 20 Oct 2026
Blackbox TLS checks: monitor failure and certificate ageBlackbox TLS checks: monitor failure and certificate age — conceptual 3D-style vector showing External probe, DNS and routing, TLS endpoint, Certificate chain, Expiry metric, Probe success.. Conceptual teaching illustration; connections show the investigation flow rather than a vendor deployment topology.CLOUVENIX / OBSERVABILITY OPERATIONSBlackbox TLS checks: monitor failure and certificate age01External probe02DNS and routing03TLS endpoint04Certificate chain05Expiry metric06Probe successConceptual investigation flow / Blackbox TLS checks: monitor failure and certificate age
Blackbox TLS checks: monitor failure and certificate age — conceptual 3D-style vector showing External probe, DNS and routing, TLS endpoint, Certificate chain, Expiry metric, Probe success.

Check the endpoint and the measurement path

A blackbox probe tests a service from an external vantage point, rather than reading only the certificate files on the application server. That matters when a load balancer, CDN or reverse proxy presents the certificate customers actually receive.

Prometheus scraping the exporter successfully is a separate event from the exporter successfully probing its target. The scrape can return metrics even when the target's TLS handshake fails. A complete monitor therefore needs probe success, collection health and certificate-age interpretation, rather than a single expiry expression.

Setup: define the target a customer reaches

Record the intended hostname, port, protocol, module and probe location. Include DNS resolution, IPv4 or IPv6 expectations, HTTP redirects and the server name used for TLS. A probe aimed at an origin IP without the right hostname can test a different certificate or fail hostname verification.

Keep certificate verification enabled for the customer-facing check. A diagnostic probe that skips verification answers a different question and should not silently replace the security check. Protect exporter access and target selection so the probing service does not become an unrestricted internal-network requester.

Inspect the TLS probe in order

  1. Check the Prometheus target status for the exporter, then examine probe_success for the requested endpoint. This separates collection failure from a tested endpoint failure.
  2. Review the selected probe module, DNS result, redirect destination and TLS settings. Use the exporter's supported debug output in a controlled context; redact sensitive URLs or headers from shared records.
  3. Inspect the returned expiry metric, such as probe_ssl_earliest_cert_expiry, only when the probe produced the expected TLS information. Compare the observed chain and hostname with the endpoint's current certificate deployment.
  4. Write separate rules for failed probes, unavailable collection and certificates approaching expiry. Define missing-series behavior so a failed handshake cannot make an expiry-only dashboard appear safe.

Illustrative incident: expiry warnings disappear when TLS fails

In this illustrative scenario, an operator watches only a days-to-expiry chart. After an endpoint certificate becomes invalid, the probe no longer produces the expected expiry observation. The graph becomes empty, but no rule treats absence or failed probing as actionable.

The team adds a probe-failure check, verifies missing-data behavior and retains the expiry alert for successful TLS observations. It rehearses the conditions against a test endpoint. The example shows a monitoring gap and does not report a real Clouvenix certificate incident.

Diagnostic evidence

ObservationEvidenceInterpretation
Exporter scrape is healthy, target failsprobe_success and debug resultProbe-level failure
Different certificate than expectedDNS, redirects and TLS hostnameDifferent endpoint path
Expiry chart has no samplesTLS result and metric presenceMissing data needs its own policy
Internal probe works, external failsProbe location and address familyNetwork vantage differs

Verify monitoring and renewal together

Use a controlled endpoint to exercise a valid certificate, an invalid hostname and an unavailable service. Confirm each condition reaches the correct test receiver. Choose warning windows based on the renewal process and response coverage, rather than copying a threshold without an owner.

After a production renewal, verify the certificate received from each relevant public termination point. A newly written file on disk does not prove every proxy reloaded or every endpoint changed. Keep origin and edge certificate responsibilities distinct when the architecture has both.

SOP

Record hostnames, probe modules, network locations, renewal owners and alert routes. Monitor probe configuration changes alongside certificate deployment. The acceptance record should show current endpoint validity and working notification paths, with an escalation for missing telemetry and a separate response to an approaching expiry.

See Clouvenix observability monitoring for implementation and operational handover.

Technical reference

Official reference 1; Official reference 2; Official reference 3. Documentation checked 19 October 2026; confirm behavior for your deployed edition and version.