HTTPS Status
TLS certificate health, HTTPS connectivity to the public URL, TLS binding status, and certificate chain validation. Traefik terminates TLS using the configured certificate. This is the most common place to diagnose scanner connectivity failures caused by certificate issues.
Fields & columns
| Name | Description |
|---|---|
Certificate Type | Self-Signed (not publicly trusted), Custom (uploaded), or Let's Encrypt (automated, publicly trusted) |
TLS Mode | The TLS configuration mode in use (e.g., self-signed, custom, acme) |
Subject CN | Common Name from the certificate subject field |
Issuer | Certificate authority that issued this certificate |
Valid From / Valid Until | Certificate validity period with days remaining color-coded |
SANs | Subject Alternative Names — hostnames and IPs the certificate is valid for |
Fingerprint SHA-256 | Unique certificate fingerprint for verification |
Public URL | The configured public HTTPS URL used for connectivity testing |
Handshake Latency | Time to complete a TLS handshake — green under 500ms, yellow 500-1000ms, red over 1000ms |
Publicly Trusted | Whether browsers and scanners accept the certificate without warnings |
UI generation / Rollback target | The certificate generation bound to :443 and the generation a rollback would restore |
Scanner anchor / Dedicated pointer | The published scanner anchor and the generation the watchdog points :8443 at — they must name the same generation |
Renewal Threshold | Days before expiry when ACME attempts automatic renewal |
Chain Length / Chain Valid | Number of certificates in the chain and whether the chain validates correctly |
Gotchas
- Self-signed certificates will always show "Publicly Trusted: No" — scanners using self-signed certs must be configured to skip TLS verification.
- Days Remaining turns red at 7 days and yellow at 30 days. ACME certificates should auto-renew well before these thresholds.
- The scanner ingress (:8443) follows the published anchor, not the UI certificate — a divergent badge here means scanners may be unable to connect, and it is fixed by a deploy, never from this page.
- Certificate chain issues (missing intermediates) cause scanner connection failures even when the certificate itself is valid.
API calls (1)
| Method | Path | Description |
|---|---|---|
| GET | /api/health/infra/https | Fetch certificate details, connectivity, TLS bindings, and chain validation |
Related
- Overview — Architecture diagram shows HTTPS status indicator
- Proxy Status — Traefik terminates TLS using this certificate
- DNS — DNS resolution is required before HTTPS connectivity can be tested