Skip to content

CertMonitor: Usage Overview

Why CertMonitor exists

CertMonitor was born out of real-world frustration. Outages and security incidents caused by expired certificates, missing Subject Alternative Names, or incomplete certificate chains. Like a lot of engineers, I was tired of the late-night alerts, the broken integrations, and the scramble to track down certificate problems before they turned into downtime or a compliance failure.

So I built CertMonitor to take that pain away. The goals were simple:

  • Zero dependencies. No third-party Python packages, ever. The advanced public key parsing and elliptic curve support are powered by Rust for speed and safety, but you never install a Python dependency to use them.
  • Portable. Python 3.10 to 3.15 is accepted by the package metadata. Install a matching native wheel, or build the extension from source.
  • Extensible. Add your own validators for organization-specific checks, compliance rules, or custom certificate logic.
  • Fast and reliable. It's designed for high-throughput, concurrent monitoring across many endpoints.

What makes CertMonitor different?

A few things set it apart:

  • Zero dependencies, by design. You can drop CertMonitor into any environment and it just works: the Python runtime layer uses the standard library, and the required native extension ships inside the wheel. (Those advanced public key and elliptic curve features are powered by Rust, but all of the orchestration and logic is pure Python standard library.)
  • Native Python first. The orchestration uses the Python standard library, with a Rust extension for certificate and key analysis.
  • A validator system. Modular, pluggable checks for everything from expiration to hostname validation, key strength, protocol version, and more.
  • A labor of love. This is a passion project, not a commercial product. We aim for production quality, and CertMonitor is always improving. Your feedback and contributions are genuinely welcome.

Example: catching the issues that matter

Here's the whole idea in five lines. Point CertMonitor at a host and ask it to validate:

from certmonitor import CertMonitor

with CertMonitor("example.com") as monitor:
    print(monitor.validate())

Out of the box, validate() runs the three default validators: expiration, hostname, and root_certificate. Each one returns a structured result keyed by its name. This is the full result of a scan against example.com at the time of writing:

{
  "expiration": {
    "is_valid": true,
    "days_to_expiry": 51,
    "expires_on": "2026-10-27T22:17:21+00:00",
    "warnings": [],
    "lifetime_days": 90,
    "lifetime_limit_days": 200,
    "status": "pass",
    "code": "expiration.pass"
  },
  "hostname": {
    "is_valid": true,
    "alt_names": [
      "example.com",
      "*.example.com"
    ],
    "identity_source": "subjectAltName",
    "common_name": "example.com",
    "common_name_matches": true,
    "matched_name": "example.com",
    "status": "pass",
    "code": "hostname.pass"
  },
  "root_certificate": {
    "is_valid": true,
    "status": "pass",
    "trust_verified": true,
    "revocation_status": "not_checked",
    "warnings": [],
    "issuer": {
      "countryName": "US",
      "organizationName": "SSL Corporation",
      "commonName": "Cloudflare TLS Issuing ECC CA 3"
    },
    "code": "root_certificate.pass"
  }
}

Every result has is_valid, and when a check fails it also gets a reason you can show in an alert. That's the whole model.

Want more checks? Turn them on

Plenty more validators ship with CertMonitor, including subject_alt_names, key_info, tls_version, weak_cipher, and the post-quantum checks. They're opt-in, so you enable the ones you care about. See the Validators section for the full list and how to enable them.

About that zero-dependency promise

CertMonitor is designed to be zero-dependency and portable: there are no third-party Python runtime dependencies. Python's SSL support and the compiled Rust extension, which ships in the wheel, are still required. The advanced public key parsing and elliptic curve support are powered by Rust, but you never need to install a third-party Python package for the orchestration or logic.

Where to go next

Start with Installation, then Basic Usage. Once you can read a result, Certificate Validators shows how to choose your checks and Passing Arguments shows how to tune them.

Prefer the shell? See the Command Line. Have the certificate as a file? See Certificates from Files. Already monitoring a fleet? Jump to Performance Tips and Monitoring Integrations. Upgrading an existing integration? Read the release notes before changing versions.