Grafana SSL certificate expiry dashboards

Grafana ssl certificate expiry dashboards shine when Prometheus (or similar) already stores probe_ssl_earliest_cert_expiry and your team lives in unified observability—but they still depend on something upstream completing correct handshakes on every public hostname.

Platform engineers evaluating certificate risk often inherit beautiful Grafana boards fed by Blackbox Exporter or custom scripts. The graphs look authoritative. The failure mode is quieter: probes run from inside the VPC, default certificate names differ from customer-facing SNI, or RDAP domain deadlines never appear next to TLS notAfter.

Uptime green does not prove browsers trust the chain customers see after CDN and load-balancer hops. Grafana visualizes what collectors emit; it does not replace an external live check that mirrors stranger traffic.

This comparison walks what Grafana does well for grafana ssl certificate expiry, where dedicated SSL monitoring diverges, and how to pair dashboards with scheduled watches without ripping out your stack.

What Grafana does well

Grafana is a presentation and alerting layer, not a certificate authority. For teams already running Prometheus, tying SSL metrics into the same boards as latency and error rates keeps expiry next to the symptoms it causes.

Unified timelines. When probe_ssl_earliest_cert_expiry drops, engineers correlate with deploys, cert rotations, and ingress changes on one screen instead of a separate monitoring silo.

Flexible alert routes. Grafana Alerting can page PagerDuty, Slack, and webhooks using the same routing trees you use for SLO burn alerts—valuable when certificate incidents should not land in a forgotten email list.

Composable data sources. You can blend Blackbox probe metrics, Loki logs from cert-manager, and business KPIs. That context helps during postmortems when a leaf renewed but the edge still serves yesterday’s serial.

Dashboard-as-code. Jsonnet, Terraform providers, and version-controlled boards make it feasible for platform teams to standardize “days until expiry” panels per environment.

Grafana excels when your collectors are accurate, your probe network matches user paths, and someone owns keeping the target list current as microservices multiply.

Where SSL expiry monitoring differs

Certificate dashboards answer “what did our probe see?” Dedicated expiry monitoring answers “what does the internet see on this hostname right now?” Those diverge more often than teams expect.

Live TLS presentation. A probe from a monitoring subnet may hit an internal VIP or a default cert while the public edge serves something else. External monitors complete the same handshake path browsers use. See internal vs external SSL check for why both layers matter.

Registrar and revalidation risk. Grafana panels rarely include RDAP domain expiration beside certificate notAfter. A valid TLS cert on a domain that failed registrar renewal still breaks the next ACME challenge. Products that bundle RDAP close that blind spot where registries publish dates.

Inventory onboarding. Prometheus target files and Ansible roles scale for engineers; they do not scale for marketing sites acquired in a merger unless someone maintains YAML forever. SaaS monitors add hostnames without maintaining probe fleets.

Staged human alerts. Engineering wants thresholds at 30, 14, 7, and 1 days without re-tuning PromQL every time leadership changes policy. Managed monitors encode that cadence and deduplicate after renewal.

Chain and trust semantics. Blackbox exposes expiry timestamps; interpreting missing intermediates or wrong SAN coverage still takes openssl skills or a product that surfaces chain trust explicitly.

Grafana remains the right pane of glass; the question is whether your upstream measurement is complete enough to trust the color of the panel.

Side-by-side criteria

Use this list when deciding whether Grafana-only coverage is enough or you should add an external certificate watch.

1. Probe vantage point. Internal-only scrapes miss CDN-terminated TLS and customer vanity domains on different edges.
2. Target inventory hygiene. Who adds new public hostnames within 24 hours of launch? If the answer is “whoever remembers YAML,” risk is high.
3. SNI and hostname coverage. Each name users type needs its own probe or SAN verification—not only the load balancer management IP.
4. Domain registration expiry. RDAP (or equivalent) on the same timeline as TLS metrics prevents surprise revalidation failures.
5. Alert deduplication after renew. Firing every evaluation interval after a fix creates alert fatigue; once-per-threshold-per-cycle is kinder.
6. Operator skill floor. PromQL and Alertmanager YAML exclude non-platform teammates who still own branded microsites.
7. Check cadence. Blackbox intervals you can afford to scrape may still be hourly or daily; match cadence to revenue impact.
8. One-shot validation. Engineers need a quick handshake check without editing Prometheus—like a public test ssl online flow before changing targets.
9. Webhook parity. Paid chat routing should mirror incident channels, not a separate Grafana contact point nobody monitors.
10. Runbook linkage. Dashboards help during incidents; proactive expiry mail reaches owners who do not have Grafana seats.

Score honestly: if more than two criteria fail, pair Grafana with an external monitor rather than expanding probe complexity alone.

Example panel query teams often start from (Blackbox Exporter):

(probe_ssl_earliest_cert_expiry - time()) / 86400

Treat the result as only as trustworthy as the targets file feeding it.

How ssldays compares

Keep Grafana for fleet observability. Add ssldays when you want live TLS reads on public hostnames—issuer, SANs, chain trust, and expiry—without operating another probe cluster. RDAP adds registrar horizons where published; rows note TLDs that omit reliable dates.

ssldays offers a free one-shot check without signup; scheduled watches alert at 30, 14, 7, and 1 days, once per threshold per renewal cycle. Email is on every plan; Slack and Discord webhooks ship on Starter and Pro. Free tier: 3 domains, daily checks; Starter: 25, hourly; Pro: 100, hourly.

Practical split: Prometheus + Grafana for platform teams and correlation; ssldays for business-owned domains, agencies, and parity checks that prove external presentation matches what Blackbox saw. Push ssldays webhook events into the same Slack channel Grafana already uses so on-call sees one thread.

If your board is fed by Prometheus blackbox SSL expiry patterns, run ssldays on the same hostname monthly and diff notAfter and serial—disagreement means your probe path is wrong, not that the dashboard lied.

Common mistakes

Dashboard without target governance. New api.staging goes live; Prometheus still probes only production apex until a user reports NET::ERR_CERT_DATE_INVALID.

Plotting expiry only on the load balancer IP. Default certificates expire on different schedules than per-tenant SNI hosts.

Assuming cert-manager green implies edge green. Renewal inside the cluster does not reload nginx, Cloudflare origin, or forgotten vanity CNAMEs.

Grafana as the only alert path for executives. VP-level stakeholders need email on registration deadlines, not Grafana viewer licenses.

Ignoring time zones in “days left” panels. notAfter is UTC; rounding errors trigger false urgency or late pages.

Next steps

Audit every hostname on your Blackbox modules list against DNS customers actually resolve. Run each through ssldays free check and compare serial and notAfter to Grafana’s last scrape.

If external and internal disagree, fix probe paths first. If they agree but inventory is painful to maintain, import public names into ssldays for staged email and webhook alerts while keeping Grafana for SRE correlation.

Review open-source SSL expiry monitors for the wider self-hosted landscape and Nagios SSL certificate expiry if legacy checks still feed legacy dashboards.