Certificate incidents

For every HTTP monitor whose target is an https:// URL, UpAll reads the site's TLS certificate about once an hour, alongside the normal checks. When the certificate is in trouble, that becomes an incident — on a deliberate two-stage ladder. For why expiry is worth this machinery, see certificate expiry risks.

The two-stage ladder

The stages map to urgency. A certificate in its final month is a renewal task with a deadline — worth a place in the record, but nothing is broken yet, so it opens as Info. An expired or unreadable certificate is actively harming users — browsers show warnings or refuse the connection outright — so it opens as Degraded. It isn't an Outage because the checks themselves may still pass; what's broken is trust, not reachability. The severity scale is explained in incident severities.

They resolve themselves

Certificate incidents follow the same no-hands lifecycle as check-driven ones. Renew the certificate and, on the next hourly read, the Info incident resolves. Serve a valid certificate where an expired one was, and the Degraded incident resolves. And if a certificate under an Info warning actually expires, the warning is superseded by the Degraded incident — the record moves up the ladder instead of holding two open entries for one certificate.

Always internal

Certificate incidents are never attributed to a client. They carry no client, so they never appear in any client portal — even when the monitor itself belongs to a client's site. That's deliberate: certificate upkeep is your operational responsibility as the MSP, and an expiring certificate is a task on your board, not an outage story a client needs to be alarmed by.

One caveat: public status pages

A public status page can list recent events — incident titles and times for the monitors on the page. That feed doesn't filter by attribution, so a certificate incident on a listed monitor may appear there. If a page's audience shouldn't see certificate housekeeping, turn off recent events for that page; the per-page toggles are covered in status page options.

Where else certificate state shows

The incident is the alarm, not the only view. Each HTTPS monitor's page shows its certificate expiry, and the live status wall carries an SSL attention strip that surfaces expiring and expired certificates across the workspace — see SSL certificate monitoring and the live status wall.