# Connector: TLS certificate (`tls`)
**Purpose**: the certificate presented by a host — CA switches (Let's Encrypt → DigiCert…), SAN additions (a new
product hostname on a shared cert is a leak of upcoming launches), renewals, key type/size, chain, negotiated
protocol/cipher/ALPN, and expiry (`extra.daysToExpiry`, `expiring` when < 14 days).
**Sensor URL**: `tls://host[:port]`. **Sensor type**: TLS, tier D. **Config**: `port?` (443), `servername?` (SNI).
**Retrieval**: a raw TLS handshake with SNI and ALPN `h2, http/1.1`, `rejectUnauthorized: false` so that an invalid
certificate is *observed* (`authorized: false`, `authorizationError`) instead of failing the check; no HTTP request
is sent. 12 s timeout. The target goes through `assertUrlAllowed` first (SSRF policy).
**Normalization**: JSON of the stable identity — subject, issuer, SANs (sorted), validFrom/To, key type and bits,
issuer chain, protocol, ALPN, authorization. Serial and fingerprint are kept in `extra` only, so a routine renewal
by the same CA with the same SANs changes validity dates (one small change) rather than everything.
**Known quirks**: `getPeerCertificate(true)` returns the chain the server sent — cross-signed roots may appear or
disappear depending on the edge node; Akamai/Cloudflare edges may present different certificates per PoP (SANs
identical in practice). Servers requiring TLS 1.3-only or client certificates are reported with `authorized: false`.
**Tests**: covered live by the validator. **Verified**: 2026-09-08 on 77 hosts (0 failures).