4.1 Intranet Host Monitoring

Internal applications can suffer the same certificate outages as public websites, but an external monitoring service cannot reach them. Intranet host monitoring uses a CertKit agent already inside your network to check those endpoints and bring their certificate status into the same host list, history, and alerting workflow as public services.

Use it for internal web applications, administrative consoles, APIs, appliances, and other TLS services addressed by:

• Internal DNS names such as intranet.corp.internal.
• Single-label hostnames such as db01.
• Private or public IP addresses.
• Public-looking names that resolve differently inside your network through split-horizon DNS.

Each monitor represents one reachable host and port, so wildcard names are not valid monitoring targets.

What CertKit Checks

The assigned agent checks whether the host is reachable, whether its certificate is valid for the hostname or IP address, when it expires, and whether its chain is trusted by the agent’s operating system. If you link the host to a CertKit-managed certificate, monitoring also confirms that the latest issued certificate was actually deployed.

Checks run every eight hours, when a host is first assigned or its name or port changes, and when you select Check Now. Intranet hosts use the same expiry history and alerts as public hosts.

The agent performs a TLS certificate check only. It does not request application pages or access private keys. No inbound connection from the CertKit cloud is required.

Choose the Monitoring Agent

The monitoring agent does not need to run on the endpoint itself. Choose an approved, current agent in the same Certificate Collection that:

• Can resolve the hostname using the same DNS view as the endpoint’s users.
• Can connect to the configured TLS port through local routing and firewall rules.
• Has the appropriate public or private root CA in its operating system trust store.

An agent running in a container uses the container’s network and trust store, which may differ from the Docker host. Place agents in each network segment or DNS view you need to observe.

Add an Intranet Host

1. Open Hosts and select Monitor New Host.
2. Enter the hostname or IP address and its TLS port.
3. Under Host Visibility, select Internal and choose the agent that can reach the endpoint.
4. Link the expected CertKit-managed certificate, or select the external-certificate option for monitoring-only.
5. Save the host, then use Check Now to confirm the network path and certificate status.

If the Internal option is unavailable, approve or update an agent in that Certificate Collection. Agents that do not support intranet host monitoring are not shown in the dropdown.

Interpreting Problems

• Could not connect: Test DNS resolution, routing, firewall policy, and the TLS port from the selected agent host.
• Certificate root is not trusted: Install the required CA root in the agent’s OS trust store. See Private PKI Trust Distribution.
• No data or a stale result: Confirm that the assigned agent is online and current, then run Check Now.
• No monitoring agent: Edit the host and assign another agent. Deleting an agent does not silently switch an internal host to public cloud monitoring.