Certificate Inventory (the Certs Page)
The Certs page gives you a certificate-first view of your estate: one entry per unique certificate, with every place it's deployed. Where the Monitors page answers "is this endpoint healthy?", the Certs page answers "what certificates do I have, and where are they?"
It builds itself — no setup
There's nothing to add or configure. The Certs page is assembled automatically from the certificates your monitors already retrieve on each poll. Add or remove monitors and the inventory updates on its own. If a certificate hasn't appeared yet, it just means the monitor presenting it hasn't completed its first poll.
How it's organized
Every distinct certificate appears once, even when it's deployed on many hosts. The list is ordered wildcards first (your *.example.com certs, which usually cover the most ground), then alphabetically by name.
Each certificate shows its common name, issuer, expiry, key type and size, SAN count, serial, and SHA-256 fingerprint — plus how many monitors it's deployed on.
Certificate status
| Status | Meaning |
|---|---|
| Valid | Not expiring within the next 30 days |
| Expiring | Expires within 30 days — plan the renewal |
| Expired | Past its expiry date — act now |
| Not yet checked | The presenting monitor hasn't completed a poll, or the certificate couldn't be read on the last attempt |
Where it's deployed
Under each certificate is a "Deployed on N monitors" section, collapsed by default. Expand it to see every endpoint serving that exact certificate, along with each one's availability and certificate status. Click any endpoint (or open ↗) to jump straight to that monitor's detail view.
Multiple versions of the same certificate
When more than one distinct certificate exists for the same name, they're grouped together in a highlighted box labelled with how many were found. This surfaces two common situations:
- A renewal or rekey still rolling out — one endpoint already serves the new certificate while another is still on the old one. Same issuer, different dates or fingerprint.
- Certificates from different certificate authorities — you deliberately run, say, a DigiCert and a Sectigo wildcard for the same name. Different issuers.
Each version in the box leads with its issuer ("via …") and shows its own expiry, fingerprint, and status, so you can tell a renewal in progress (same CA, newer dates) from intentional multi-CA (different CAs) at a glance — and spot any endpoint that was missed during a renewal.
Finding things
- Search by name, SAN, issuer, or fingerprint.
- Filter by status, type (wildcard vs single/SAN), versions (single vs multiple deployed), or issuer.
- Source tabs separate certificates seen by your Public (hosted) pollers from those seen by Private (on-network) pollers. Azure and AWS tabs are reserved for upcoming cloud-certificate discovery.
Tips
- Sort your attention by the Expiring and Expired counts in the header — they're the certs that need action.
- A box showing multiple versions right after a renewal is your cue to check the "older" endpoints and confirm they picked up the new certificate.
- The fingerprint and serial are the fastest way to confirm two endpoints are serving the exact same certificate, not just the same name.