# Connector: TLS certificate (tls)

Purpose: the certificate presented by a host — CA switches (Let's Encrypt → DigiCert…), SAN additions (a new product hostname on a shared cert is a leak of upcoming launches), renewals, key type/size, chain, negotiated protocol/cipher/ALPN, and expiry (extra.daysToExpiry, expiring when < 14 days). Sensor URL: tls://host[:port]. Sensor type: TLS, tier D. Config: port? (443), servername? (SNI). Retrieval: a raw TLS handshake with SNI and ALPN h2, http/1.1, rejectUnauthorized: false so that an invalid certificate is observed (authorized: false, authorizationError) instead of failing the check; no HTTP request is sent. 12 s timeout. The target goes through assertUrlAllowed first (SSRF policy). Normalization: JSON of the stable identity — subject, issuer, SANs (sorted), validFrom/To, key type and bits, issuer chain, protocol, ALPN, authorization. Serial and fingerprint are kept in extra only, so a routine renewal by the same CA with the same SANs changes validity dates (one small change) rather than everything. Known quirks: getPeerCertificate(true) returns the chain the server sent — cross-signed roots may appear or disappear depending on the edge node; Akamai/Cloudflare edges may present different certificates per PoP (SANs identical in practice). Servers requiring TLS 1.3-only or client certificates are reported with authorized: false. Tests: covered live by the validator. Verified: 2026-09-08 on 77 hosts (0 failures).