One possibility that was discussed internally - is the expiration check handled in a separate https operation from the service check itself? Is there any chance that check is not sending SNI part of the interaction?

This particular cert was being delivered from a proxy server that hands out the certs via SNI, and the "default" cert (with no SNI element) is not expired.

Realized that easiest way to test this would just be to define a 90 day expiration warning on a server with a standard letsencrypt issued cert - that should fail almost immediately if the check is working properly.

So I set a 95 day expiration warning - and immediately received alerts from a FEW of my services, but NOT all that I would have expected.

Also noticed something additional - on ONE of the servers - the certificate error reported:

[home.domain.com][https://home.domain.com/] server certificate accounts.google.com will be expired in 52 days

That particular server kicks over to google for OIDC authentication. It really shouldn't be reporting the certificate of the target server - especially when the ACTUAL certificate on that box is set to expire in about 34 days. It should be reporting the certificate status before redirections are applied.

Hmm... That's what caused my initial problem, the servers that had the issue with all do redirects to OIDC/SAML auth providers, who's certificates are NOT expiring.

I think to do this and have it actually give the correct results, the code needs to do something leveraging the axios "beforeRedirect" callback function.

Confirmed - just set up an explicit monitor with redirects disabled, and immediately started getting the expiry alert. So at least I've got a workaround at the moment - I can define an extra "0 redirects" monitor for every https monitor - however, ideally, this should probably perform the tls cert check on every hop.

Could you edit the title to something shorter like TLS Expiry not checking intermediate redirect targets

See https://github.com/louislam/uptime-kuma/blob/master/CONTRIBUTING.md if you are able to provide a fix for this behaviour ^^