SSL/TLS check quickstart

By the end of this guide you’ll have TLS expiry monitoring active on an existing HTTP check, and you’ll know how to view its current status and expiry countdown.

Prerequisites

An existing HTTP check pointing at an https:// URL. If you don’t have one, follow the HTTP checks quickstart.

Open the HTTP check, click Settings.
Toggle Monitor TLS certificate on. Save.

A paired TLS check is provisioned within seconds; the first handshake happens on the next HTTP tick.

# On create
curl -X POST https://api.siteqwality.com/http/job \
  -H "Authorization: Bearer $SITEQWALITY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "friendly_name": "API homepage",
    "method": "GET",
    "uri": "https://api.example.com/",
    "monitor_tls": true,
    "monitor_dns": false,
    "timeout_ms": 15000,
    "run_interval_seconds": 600,
    "group_notification_ids": []
  }'

# Or update an existing check
curl -X PUT https://api.siteqwality.com/http/job/$JOB_ID \
  -H "Authorization: Bearer $SITEQWALITY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "monitor_tls": true }'

2. View the TLS check status

Dashboard
API

The HTTP check page now shows a TLS sub-card with the current status, hostname, and an expiry countdown.

The HTTP check’s response includes the paired tls_job_id. Fetch it directly:

curl https://api.siteqwality.com/tls/job/$TLS_JOB_ID \
  -H "Authorization: Bearer $SITEQWALITY_API_KEY"

You get back the TlsJob:

{
  "id": "...",
  "http_job_id": "...",
  "current_status": "healthy",
  "domain": "api.example.com",
  "expiry_date": "2026-12-15T08:00:00Z",
  "last_run_at": "2026-05-03T14:32:00Z",
  ...
}

3. Verify alerting works

Force a TLS failure path by:

Pointing an HTTP check at a known-broken-cert site (e.g. https://expired.badssl.com) for ~30 minutes.
The TLS check flips to failed.
The HTTP check’s notification group fires.

What’s next

TLS reference Status enum, fields, and expiry-warning thresholds.

DNS checks The other check type often paired with HTTP.