- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
SSL tests allow you to proactively monitor the validity and expiration of your SSL/TLS certificates to ensure secure connections between your key services and users. If your certificate is about to expire or becomes compromised, Datadog sends you an alert with details on the failure, allowing you to quickly pinpoint the root cause of the issue and fix it.
SSL tests can run from both managed and private locations depending on your preference for running the test from outside or inside your network. SSL tests can run on a schedule, on-demand, or directly within your CI/CD pipelines.
After choosing to create a SSL
test, define your test’s request.
Specify the Host and the Port to run your test on. The default SSL port is 443
.
Add Advanced Options (optional) to your test:
.crt
) and the associated private key (.key
) in PEM
format.You can use the openssl
library to convert your certificates. For example, convert a PKCS12
certificate to PEM
formatted private keys and certificates.
openssl pkcs12 -in <CERT>.p12 -out <CERT_KEY>.key -nodes -nocerts
openssl pkcs12 -in <CERT>.p12 -out <CERT>.cert -nokeys
Name your SSL test.
Add env
Tags as well as any other tag to your SSL test. You can then use these tags to filter through your Synthetic tests on the Synthetic Monitoring & Continuous Testing page.
Click Test URL to try out the request configuration. A response preview is displayed on the right side of your screen.
Assertions define what an expected test result is. After you click Test URL, basic assertions on certificate validity, expiration data, TLS version, and response time
are added based on the response that was obtained. You must define at least one assertion for your test to monitor.
Type | Operator | Value type |
---|---|---|
certificate | expires in more than , expires in less than | Integer (number of days) |
property | contains , does not contain , is , is not ,matches , does not match | String Regex |
response time | is less than | Integer (ms) |
maximum TLS version | is less than , is less than or equal , is , is more than , is more than or equal | Decimal |
minimum TLS version | is more than , is more than or equal | Decimal |
You can create up to 20 assertions per API test by clicking New Assertion or by clicking directly on the response preview:
To perform OR
logic in an assertion, use the matches regex
or does not match regex
comparators to define a regex with multiple expected values for the same assertion type like (0|100)
. The test result is successful if the property assertion’s value is 0 or 100.
If a test does not contain an assertion on the response body, the body payload drops and returns an associated response time for the request within the timeout limit set by the Synthetics Worker.
If a test contains an assertion on the response body and the timeout limit is reached, an Assertions on the body/response cannot be run beyond this limit
error appears.
Select the Locations to run your SSL test from. SSL tests can run from both managed and private locations depending on your preference for monitoring certificates from outside or inside your network.
Datadog’s out-of-the-box managed locations allow you to test public-facing websites and endpoints from regions where your customers are located.
Americas | APAC | EMEA |
---|---|---|
Canada Central (AWS) | Hong Kong (AWS) | Cape Town (AWS) |
Northern California (AWS) | Mumbai (AWS) | Frankfurt (AWS) |
Northern Virginia (AWS) | Seoul (AWS) | Ireland (AWS) |
Ohio (AWS) | Singapore (AWS) | London (AWS) |
Oregon (AWS) | Sydney (AWS) | Paris (AWS) |
São Paulo (AWS) | Tokyo (AWS) | Stockholm (AWS) |
Virginia (Azure) | Osaka (AWS) | Milan (AWS) |
Jakarta (AWS) | Bahrain (AWS) |
The Datadog for Government site (US1-FED) uses the following managed location:
Americas |
---|
US-West |
SSL tests can run:
Set alert conditions to determine the circumstances under which you want a test to fail and trigger an alert.
When you set the alert conditions to: An alert is triggered if any assertion fails for X minutes from any n of N locations
, an alert is triggered only if these two conditions are true:
Your test can trigger retries X
times after Y
ms in case of a failed test result. Customize the retry interval to suit your alerting sensibility.
Location uptime is computed on a per-evaluation basis (whether the last test result before evaluation was up or down). The total uptime is computed based on the configured alert conditions. Notifications sent are based on the total uptime.
A notification is sent by your test based on the alerting conditions previously defined. Use this section to define how and what to message your team.
Similar to how you configure monitors, select users and/or services that should receive notifications either by adding an @notification
to the message or by searching for team members and connected integrations with the dropdown menu.
Enter the notification message for your test. This field allows standard Markdown formatting and supports the following conditional variables:
Conditional Variable | Description |
---|---|
{{ #is_alert }} | Show when the test alerts. |
{{ ^is_alert }} | Show unless the test alerts. |
{{ #is_recovery }} | Show when the test recovers from alert. |
{{ ^is_recovery }} | Show unless the test recovers from alert. |
{{ #is_renotify }} | Show when the monitor renotifies. |
{{ ^is_renotify }} | Show unless the monitor renotifies. |
{{ #is_priority }} | Show when the monitor matches priority (P1 to P5). |
{{ ^is_priority }} | Show unless the monitor matches priority (P1 to P5). |
Specify how often you want your test to re-send the notification message in case of test failure. To prevent renotification on failing tests, leave the option as Never renotify if the monitor has not been resolved
.
Click Create to save your test configuration and monitor.
For more information, see Using Synthetic Test Monitors.
To create a local variable, click Create a Local Variable. You can select one of the following available builtins to add to your variable string:
n
digits.n
letters.n
characters.n
units.n
units.To obfuscate local variable values in test results, select Hide and obfuscate variable value. Once you have defined the variable string, click Add Variable.
You can use the global variables defined on the Settings page in the URL, advanced options, and assertions of your SSL tests.
To display your list of variables, type {{
in your desired field.
A test is considered FAILED
if it does not satisfy one or more assertions or if the request prematurely failed. In some cases, the test can fail without testing the assertions against the endpoint.
These reasons include the following:
CONNRESET
DNS
INVALID_REQUEST
SSL
TIMEOUT
TIMEOUT
can happen:TIMEOUT: The request couldn't be completed in a reasonable time.
indicates that the request duration hit the test defined timeout (default is set to 60s).
For each request only the completed stages for the request are displayed in the network waterfall. For example, in the case of Total response time
only being displayed, the timeout occurred during the DNS resolution.TIMEOUT: Overall test execution couldn't be completed in a reasonable time.
indicates that the test duration (request + assertions) hits the maximum duration (60.5s).By default, only users with the Datadog Admin and Datadog Standard roles can create, edit, and delete Synthetic SSL tests. To get create, edit, and delete access to Synthetic SSL tests, upgrade your user to one of those two default roles.
If you are using the custom role feature, add your user to any custom role that includes synthetics_read
and synthetics_write
permissions.
Access restriction is available for customers using custom roles on their accounts.
You can restrict access to an SSL test based on the roles in your organization. When creating an SSL test, choose which roles (in addition to your user) can read and write your test.
Additional helpful documentation, links, and articles: