PRTG Manual: SSL/TLS Certificate Sensor

Enabled Beta Sensors experimental feature

This sensor requires that the Beta Sensors experimental feature is enabled.

For more information, see the Knowledge Base: What are beta sensors and how can I use them?

IPv6

This sensor supports IPv6.

Performance impact

This sensor has a very low performance impact.

Lookups

This sensor uses lookups to determine the status values of one or more channels.

Scanning interval

The recommended scanning interval of this sensor is 1 hour.

Connection Timeout (Sec.)

Define a timeout for the Transmission Control Protocol (TCP) connection. This is the time the sensor waits to establish a connection to the host. Enter an integer between 1-300. The default connection timeout is 30 seconds.

Handshake Timeout (Sec.)

Define a timeout for the SSL/TLS handshake. This is the time the sensor waits to complete the SSL/TLS handshake. Enter an integer between 1-300. The default handshake timeout is 10 seconds.

Port

Enter the port for the connection to the target endpoint. PRTG supports the port numbers 1-65535. Enter an integer.

The default port is 443.

SNI Inheritance

Select if you want to use the Server Name Indication (SNI) from the parent device or a custom SNI.

• Inherit SNI from parent device (default): Determine the SNI from the host address of the parent device.
• Use custom SNI: Use this setting if the device that the sensor queries has multiple certificates with the same IP address and port combination.

SNI Hostname

This setting is only visible if you select Use custom SNI above.

Enter the custom SNI hostname.

Certificate Name Validation

Define if you want the sensor to validate the certificate name:

• Compare certificate names with device address or SNI (default): Check the Subject Alternative Names (SANs) to validate the certificate. The sensor uses the Common Name (CN) as fallback if no SAN is present. If the SANs or CN of the certificate do not match the device address or SNI, the sensor shows the Down status.
• Do not compare certificate names with device address or SNI: Do not check the validity of the SANs or CN of the certificate.

Certificate Revocation Check

Define if PRTG checks if the issuer revoked the certificate:

• Enable (default)
• Disable

This requires a trusted Root CA certificate. The sensor downloads the respective Certificate Revocation List (CRL) and caches it. If the CRL expiration is longer than 24 hours, the sensor refreshes it after 24 hours. If the CRL expiration is less than 24 hours, the sensor refreshes it when it expires.

Primary Channel

Select a channel from the list to define it as the primary channel. In the device tree, PRTG displays the last value of the primary channel below the sensor's name. The available options depend on what channels are available for this sensor.

You can set a different primary channel later by clicking below a channel gauge on the sensor's Overview tab.

Graph Type

Define how this sensor shows different channels:

• Show channels independently (default): Show a graph for each channel.
• Stack channels on top of each other: Stack channels on top of each other to create a multi-channel graph. This generates a graph that visualizes the different components of your total traffic.
  You cannot use this option in combination with manual Vertical Axis Scaling (available in the channel settings).

Stack Unit

This setting is only visible if you select Stack channels on top of each other above.

Select a unit from the list. PRTG stacks all channels with this unit on top of each other. By default, you cannot exclude single channels from stacking if they use the selected unit. However, there is an advanced procedure to do so.

Result Handling

Define what PRTG does with the sensor result:

• Discard result (default): Do not store the sensor result.
• Store result: Store the sensor result and the last response in the \Logs\sensors subfolder of the PRTG data directory on the probe system. The file name is Result of Sensor [ID].log. This setting is for debugging purposes. PRTG overwrites this file with each scanning interval.

This option is not available when the sensor runs on the hosted probe of a PRTG Hosted Monitor instance.

In a cluster, PRTG stores the result in the PRTG data directory of the master node.

Certificate Name Validation

If you select Compare certificate names with device address or SNI (default), this channel displays the certificate name validation result

• Up status: The SAN or CN of the certificate matches device address or SNI
• Down status: The SAN or CN of the certificate does not match device address or SNI
• Unknown status: Unknown

Days to Expiration

The number of days until the certificate expires

This channel is the primary channel by default.

This channel has default limits:

• Lower error limit: 7
• Lower warning limit: 28

Downtime

In the channel table on the Overview tab, this channel never shows any values. PRTG uses this channel in graphs and reports to show the amount of time in which the sensor was in the Down status.

Public Key Length

The length of the public key of the certificate in bits

Public Key Strength

The strength of the public key of the certificate

• Up status: Good, Perfect
• Warning status: Weak
• Down status: Insecure
• Unknown status: Unknown

For the strength of the most common public key types and sizes, see Public Key Strengths.

Revocation Status

The revocation status of the certificate

• Up status: Not Revoked
• Warning status: Unable To Check Revocation Status
• Down status: Revoked
• Unknown status: Unknown

Signed By

If the certificate is self-signed or signed by a CA

• Up status: Self-Signed, CA-Signed
• Unknown status: Unknown

Trust Status

If the certificate is trusted or not

• Up status: Trusted
• Down status: Not Trusted
• Unknown status: Unknown

RSDA, DSA, DH

<1024

Insecure

≥1024

Weak

≥3072

Good

≥7680

Perfect

ECC

<224

Insecure

≥224

Weak

≥256

Good

≥384

Perfect

ED25519

Fixed

Good

ED448

Fixed

Perfect