Endpoints
An endpoint is an IP and port serving TLS, for example 203.0.113.10:443. Where Certificates answers “what do I have”, this answers “what is actually being served, and how”.
Endpoints appear on their own. Public scanning creates them from the domains you verified, and a Sentinel’s network scan creates them from the ranges you allowed. You can also add one by hand.
The detail page
Section titled “The detail page”Opening an endpoint shows what the handshake negotiated: the TLS version, the cipher suite, the key-exchange group, whether OCSP stapling is on and whether HSTS is set. Below that, a card per certificate the endpoint has served.
That is the screen to open when a certificate looks right but a client still refuses the connection. The certificate can be fine while the protocol version or the chain being served is not.
Active and retired certificates
Section titled “Active and retired certificates”When an endpoint has served more than one certificate over time, each card carries an activity dot.
- Active: observed in the last few days.
- Retired: silent at this endpoint for six days or more. Retired cards sort to the bottom and are labelled, so the current certificate stands out.
Retired means not currently observed by NoCert, which is not the same as no longer served. The FAQ lists the setups where a live certificate can look retired.
The timestamp beside the dot is the ground truth: the last time NoCert saw that certificate there.
Activity marking is a visual signal, and the alerting pipeline uses the same six-day window: a certificate silent that long stops producing expiry alerts, so a decommissioned host does not page anyone.
That gate fails open. If every network-observed certificate in your estate goes stale at once, which usually means NoCert has stopped reaching your hosts rather than that they all went away, everything is put back in scope rather than alerting going quiet.
When the endpoint itself goes quiet
Section titled “When the endpoint itself goes quiet”If NoCert has not managed to scan the endpoint at all for six days, a banner appears at the top of the page:
Endpoint last seen 12d ago
While that banner is up, the individual certificates carry no activity dot. The silence belongs to the endpoint, not to any one certificate. Check the Sentinel covering it, or how NoCert reaches the address from the internet, before drawing conclusions per certificate.
Rescan on the detail page queues an immediate scan of that endpoint, which is the quickest way to tell a dead host from a scanning problem. It is operators and owners only, and it refuses a second run for a minute afterwards.
Tags do three jobs: they organize the list, they scope what a viewer can see, and a notification rule can filter on them. A tag is how you carve the estate up by team or by environment.
Tags are normalized when you save them: lowercased, spaces become hyphens, anything else is stripped, and each one is cut to 20 characters. An endpoint holds at most 20. Use the tag exactly as it appears afterwards when you reference it in a rule, since the truncation is silent.
Tagged endpoints also survive a domain deletion that would otherwise remove them.
Adding an endpoint by hand
Section titled “Adding an endpoint by hand”If discovery has not found a host you know about, add it from this page.
The name has to sit under a domain you have verified, and it has to resolve publicly. NoCert refuses an IP address on its own, a host outside your verified zones, and a name that only resolves inside your network. That last case is what Sentinels are for.
The endpoint is not created on save. NoCert queues a scan and the row appears once the result lands, so an empty list straight afterwards is normal rather than a failure.