Skip to main content
Version: 0.9

Endpoint & SSL monitoring

TokenTimer can monitor HTTPS endpoints for SSL certificate expiration and endpoint health. When you add an endpoint, TokenTimer automatically fetches the SSL certificate, creates a token to track its expiration, and optionally performs periodic health checks.

Open Endpoint & SSL monitor on the dashboard to add endpoints, or use the Domain Checker to discover and bulk-import certificates for a whole root domain.

How SSL tokens are created​

  • When you add a URL (for example https://example.com), TokenTimer connects via TLS to read the SSL certificate.
  • A token is automatically created with the hostname as its name (for example "example.com"), the certificate expiration date, issuer, serial number, and subject.
  • The token's domains field is populated with the hostname and the location field stores the full URL.
  • The token type is ssl_cert with category cert.
  • On subsequent SSL checks, TokenTimer refreshes the linked token's certificate metadata (expiration date, issuer, subject, serial number) when the certificate changes or is renewed.

Health checking​

  • Enable/disable: health checking is off by default and can be toggled per endpoint.
  • Check intervals: every 1 min, 5 min, 30 min, hourly, or daily.
  • What is checked: an HTTP GET request is made to the URL. A 2xx or 3xx response is "healthy"; 4xx/5xx or timeouts are "unhealthy".
  • Dashboard indicator: a health status icon appears next to the token's expiry pill (green = healthy, orange = unhealthy, red = error, gray = pending).
  • Alerts: when the status transitions from healthy to unhealthy, an alert is triggered. See Endpoint Health Alerts for the alerting strategy, including the "alert after failures" setting.

Managing endpoints​

  • Click "Endpoint & SSL monitor" on the dashboard to open the Endpoint & SSL monitoring modal. From there you can add a single URL for health checks and SSL tracking, or use the Domain Checker to discover and bulk-import every SSL certificate ever issued for a root domain.
  • The modal lists monitored endpoints with SSL status, health status, response time, and check interval.
  • Use the refresh button to trigger a manual health check.
  • Deleting an endpoint monitor does not delete the associated SSL token.

Network access for endpoint checks​

Self-hosted TokenTimer runs endpoint health checks from your own infrastructure. When deployed on the same network as your services, it can reach internal endpoints and resolve private DNS names without requiring any firewall exceptions or IP allowlisting. This makes it suitable for monitoring internal APIs, staging environments, and services that are not publicly accessible.

This is a key difference from TokenTimer Cloud, which runs health checks from its own infrastructure and can only reach publicly resolvable endpoints (optionally behind an egress-IP allowlist). Because self-hosted TokenTimer runs on your network, there is no egress IP to allowlist and no concept of "public-only" endpoints; if the host running TokenTimer can reach the target, TokenTimer can monitor it.

CertOps bridge​

When CertOps is enabled on your deployment, endpoint SSL monitoring also feeds the managed certificate inventory: each observation of the served certificate is recorded against a managed certificate row. See Endpoint monitoring bridge.