Custom port checks

TLS Certificate Monitoring for Custom Ports

Check public HTTPS services on ports like 8443, then monitor the certificate if that port is part of a customer-facing workflow.

Search intent

Some important HTTPS services do not run on port 443

A small team may have an admin panel, customer portal, appliance UI, webhook endpoint, or staging service exposed on a custom public port. If the certificate expires there, the warning can still block real work.

The main website can look healthy

example.com may be fine on port 443 while example.com:8443 is serving an expired or mismatched certificate.

Custom ports are easy to overlook

They are often set up once and then forgotten until a customer, partner, or internal user reports a warning.

Private networks are out of scope

The public checker only checks websites and services reachable from the public internet.

Manual check

Enter the hostname with the port you actually use

If a service is public and uses a custom TLS port, include the port in the target. The result should make clear whether the certificate is valid for that hostname and when it expires.

Use hostname:port

Enter example.com:8443 when users connect directly to that port.

Use a full URL when it is clearer

https://example.com:8443 works too and helps avoid checking the wrong service.

Check the exact public name

A certificate can be valid for one hostname and still fail on another hostname pointing to the same server.

Monitoring value

Monitor custom ports only when they matter to users

Cert Monitor keeps the default UI simple: most people only need a domain or URL. Custom ports stay available for public services that need the same outside-in monitoring as the main website.

Keep the main flow simple

The default check assumes port 443, so non-technical owners are not forced to think about ports.

Use advanced input when needed

A custom port can be checked and later monitored when it is part of a real customer or partner path.

Separate monitors reduce guesswork

A custom port should be tracked as its own target, because it can fail while the main site stays valid.