Tag Archives: certificate monitoring

Monitoring Internal and Private CA Certificates with Generator Labs

Leave a reply

External certificate monitoring works well for public-facing infrastructure, but it has an obvious blind spot: it can’t reach anything inside your private network. Internal APIs, databases with TLS-encrypted connections, mail servers on non-public ports, self-signed certificates, and infrastructure issued by a private CA all go completely unmonitored. Those certificates still expire. When they do, the failures tend to be worse, because internal services rarely have the same visibility as public ones.

Generator Labs internal certificate monitoring solves this with a lightweight on-premise agent you deploy as a Docker container inside your network.

How It Works

Diagram showing the Generator Labs private monitoring agent connecting internal hosts to the platform over outbound HTTPS

The agent runs inside your private network, connects to your internal hosts, retrieves their certificates, and reports the data back to the Generator Labs platform over outbound HTTPS. No inbound firewall rules are required. Private keys never leave your network. From the platform’s side, internal monitors look and behave exactly like external ones.

What It Can Monitor

The agent connects to any TLS endpoint your network can reach:

  • Internal web servers and APIs
  • Databases with TLS connections (PostgreSQL, MySQL, MongoDB, Redis)
  • Internal mail servers (SMTP, IMAP, POP3 with STARTTLS or implicit TLS)
  • IoT devices and embedded systems serving TLS on custom ports
  • Any service running TLS on any port

It runs the same eight checks as external monitoring: expiration, chain integrity, hostname validation, CA trust, revocation, fingerprint changes, flapping, and CAA records.

Private CA Support

If your internal certificates are issued by a private CA, you can import that CA’s root certificate into the platform. The agent then validates certificate chains all the way to your private root, so chain integrity checks work correctly for internally-issued certificates, not just publicly-trusted ones.

Alerts

All the same notification channels are available: email, Slack, PagerDuty, Discord, webhooks, AWS SNS, and more. Internal certificate expiration or chain failures trigger the same alert pipeline as any other monitoring event.

Getting Started

The agent is open source and available at github.com/generator-labs/agent. Deploying it takes a few minutes: pull the Docker image, set your API credentials as environment variables, and configure the hosts you want to monitor. Full setup instructions are on the internal certificate monitoring page.

GoodTLS: Expert TLS/SSL Configuration Guides for Every Stack

Leave a reply

TLS configuration is one of those things everyone knows matters, but the documentation across different platforms is fragmented, inconsistent, and sometimes outdated. GoodTLS collects expert-recommended TLS/SSL configuration guides in one place, organized by application. No sifting through Stack Overflow threads or vendor docs that haven’t been updated since TLS 1.0 was acceptable.

GoodTLS homepage showing TLS/SSL configuration guides by application

Web Server Guides

The most common use case, and where TLS configuration has the most visibility. GoodTLS covers the major web servers with guides that focus on what actually matters for a modern deployment: TLS 1.2/1.3-only configurations, AEAD-only cipher suites, OCSP stapling, and secure header settings.

Each guide goes beyond a copy-paste snippet and explains the tradeoffs: which cipher suites to drop, why session ticket rotation matters, and what HSTS preloading requires.

GoodTLS Nginx configuration guide showing protocol version settings

Mail Server Guides

Mail server TLS configuration has real deliverability implications. Get the STARTTLS settings wrong and you are either degrading security or breaking mail flow. The Postfix TLS guide and Exim TLS guide cover both outbound and inbound TLS configuration, certificate requirements, and policy enforcement. Dovecot and Sendmail are covered as well.

If you are running your own mail infrastructure, certificate hygiene is part of the picture. Certificate monitoring tracks expiry across all your domains and alerts before anything lapses. An expired cert on your SMTP server will cause delivery failures before most teams even notice. On the deliverability side, blacklist monitoring watches your sending IPs against hundreds of blocklists so you catch reputation problems early.

Database and Infrastructure Guides

Database TLS is frequently an afterthought, but it is essential for any environment where the application and database are not co-located, or where compliance requirements apply. GoodTLS covers:

For infrastructure that handles DNS over TLS or encrypted replication traffic, having a reference for the correct cipher and protocol settings saves time and avoids the configuration drift that comes from guessing.

Why Configuration Quality Matters

A misconfigured TLS stack is not just a security risk. Weak cipher suites, missing OCSP stapling, and deprecated protocol versions can trigger browser warnings, fail PCI DSS or SOC 2 security scans, or cause mail rejections from strict receiving servers. The cost of getting it wrong shows up in unexpected ways.

GoodTLS is free to use and covers most common application stacks. If you are also looking to automate certificate monitoring across your infrastructure, Generator Labs certificate monitoring tracks SSL/TLS certificate expirations with automated alerts before they become outages.

Generator Labs: Blacklist and Certificate Monitoring for Email and Infrastructure Teams

Leave a reply

Generator Labs provides infrastructure monitoring for teams that need to stay ahead of two specific problems: IP and domain blacklistings that kill email deliverability, and SSL certificates that expire without warning. Both products run in the same portal, so you manage everything in one place.

Blacklist Monitoring

Blacklist monitoring runs continuous checks of your IPv4 addresses, IPv6 addresses, and domains against hundreds of RBL and URIBL data sources. The moment a listing is detected, alerts go out through whatever channels you have configured: email, SMS, Slack, Discord, PagerDuty, or webhooks.

Coverage is the differentiator. Free one-shot tools check a handful of the major lists. Generator Labs checks well over a hundred data sources on a schedule, including 30+ premium sources on Enterprise and Ultimate plans that free tools do not cover. You get notified when something changes; you are not logging in to run a manual check.

Other features worth knowing:

Full IPv6 support. IPv4 and IPv6 addresses are both monitored across all plans. As more mail infrastructure goes dual-stack, IPv6 blacklisting is a real and growing issue that most monitoring tools still treat as secondary.

Shareable public reports. Every monitored host gets a public report URL you can hand to a client, ISP, or manager without giving anyone portal access.

REST API. Full programmatic access to monitoring data and controls, with client libraries for PHP, Node.js, and Python.

Generator Labs RBL Monitoring hosts list

Blacklist Monitoring Pricing

  • Free: 1 host, 48-hour check interval, 100+ data sources. Free forever, no credit card required.
  • Professional: $8/month for 20 hosts at 24-hour intervals.
  • Enterprise: $16/month for 50 hosts at 12-hour intervals, premium data sources, custom run times.
  • Ultimate: $0.005 per check, unlimited hosts, custom intervals, all premium sources.

The Ultimate pay-per-check plan scales cleanly for larger deployments. Running 50 hosts daily against 150 data sources works out to roughly $11/month.

Certificate Monitoring

Certificate monitoring tracks SSL/TLS certificate expirations across your domains and sends alerts before anything expires. Add your domains, set alert thresholds, and the service runs automatically from there.

Both publicly-trusted and private or internal CA certificates are supported, which matters for teams running internal infrastructure that does not go through a public CA. Certificate expiry causes outages that are entirely preventable; automated monitoring removes the spreadsheet tracking and calendar reminders that most teams fall back on.

Generator Labs Certificate Monitoring monitors list

Monitoring profiles let you define reusable alert configurations across multiple monitors. Set custom expiration alert windows (5, 15, 30, 60 days, or any combination you need), choose which failure types trigger alerts, and assign private CAs or internal monitoring agents. One profile can cover dozens of monitors.

Generator Labs Certificate Monitoring add profile dialog

Certificate Monitoring Pricing

Certificate monitoring is priced at $0.01 per host per day, with no fixed tiers. You pay for what you monitor and can add or remove domains at any time.

Who It Is For

  • Email service providers and hosting companies monitoring large IP ranges
  • IT and security teams who need immediate notification when a host gets listed
  • Organizations managing many domains who need certificate expiry visibility without manual tracking
  • Developers who want API access to monitoring data for automation or integration

Get Started

Generator Labs offers continuous blacklist monitoring and certificate monitoring with solid alert coverage and a complete API. The free tier is a real free tier. Sign up at portal.generatorlabs.com to get started, no credit card required.