TypeScript 55.4%
Python 43.2%
SQL 1.2%
1# Connector: TLS certificate (`tls`)2**Purpose**: the certificate presented by a host — CA switches (Let's Encrypt → DigiCert…), SAN additions (a new3product hostname on a shared cert is a leak of upcoming launches), renewals, key type/size, chain, negotiated4protocol/cipher/ALPN, and expiry (`extra.daysToExpiry`, `expiring` when < 14 days).5**Sensor URL**: `tls://host[:port]`. **Sensor type**: TLS, tier D. **Config**: `port?` (443), `servername?` (SNI).6**Retrieval**: a raw TLS handshake with SNI and ALPN `h2, http/1.1`, `rejectUnauthorized: false` so that an invalid7certificate is *observed* (`authorized: false`, `authorizationError`) instead of failing the check; no HTTP request8is sent. 12 s timeout. The target goes through `assertUrlAllowed` first (SSRF policy).9**Normalization**: JSON of the stable identity — subject, issuer, SANs (sorted), validFrom/To, key type and bits,10issuer chain, protocol, ALPN, authorization. Serial and fingerprint are kept in `extra` only, so a routine renewal11by the same CA with the same SANs changes validity dates (one small change) rather than everything.12**Known quirks**: `getPeerCertificate(true)` returns the chain the server sent — cross-signed roots may appear or13disappear depending on the edge node; Akamai/Cloudflare edges may present different certificates per PoP (SANs14identical in practice). Servers requiring TLS 1.3-only or client certificates are reported with `authorized: false`.15**Tests**: covered live by the validator. **Verified**: 2026-09-08 on 77 hosts (0 failures).16