Cert Health
@lint/cert-healthv2026.05.22.1
01README
TLS-certificate expiry tracker — fetch NPM-managed cert inventory and probe public-facing hosts via openssl s_client, classified by days-until-expiry.
02Models
@lint/cert-healthv2026.05.22.1cert-health.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| npmBaseUrl | string | NPM base URL, e.g. http://192.168.4.60:81 (no trailing slash) |
| npmEmail | string | NPM admin email (vault-resolved) |
| npmPassword | string | NPM admin password (vault-resolved) |
| warnThresholdDays | number | Days-remaining below which a cert is `warn` |
| criticalThresholdDays | number | Days-remaining below which a cert is `critical` |
| requestTimeoutSec | number | |
| probeTimeoutSec | number |
fn syncNpm()
Log into NPM, fetch /api/nginx/certificates, classify by days-until-expiry, write inventory + summary.
fn probe(hosts: array, defaultPort: number)
Open a TLS connection to each host (port 443 by default) via openssl s_client, extract the leaf cert, classify by days-until-expiry. Probes run in parallel.
| Argument | Type | Description |
|---|---|---|
| hosts | array | Hostnames to probe. Use `host:port` to override the default port. |
| defaultPort | number |
Resources
npm_inventory(infinite)— Full list of NPM-managed certs with days-until-expiry.
npm_summary(infinite)— Counts + top-10 closest-to-expiry NPM certs.
probe_results(infinite)— Per-host TLS probe results from the last `probe` run.
probe_summary(infinite)— Counts + top-10 closest-to-expiry hosts from probe results.
sync_log(infinite)— Per-method audit (syncNpm, probe).
03Workflows
@lint/cert-health-check
TLS cert health audit: cert-health.syncNpm → cert-health.probe (public hostnames from @lint/dns-policy) syncNpm pulls every cert NPM is managing; probe verifies the public end-to-end TLS path (CDN/proxy → NPM → backend) by handshaking against the hostnames the dns-policy publishes externally. Read-only telemetry; no reconciliation. Assumes a model instance named `cert-health` (of type @lint/cert-health) and a `dns-policy` instance (of type @lint/dns-policy) exist. If you don't run dns-policy,
auditPull NPM cert inventory and probe public-facing hosts
1.sync-npm-certscert-health.syncNpm— Log into NPM and fetch /api/nginx/certificates
2.probe-public-hostscert-health.probe— TLS-handshake every dns-policy publicVhost; record subject/issuer/notAfter
04Stats
A
100 / 100
Downloads
0
Archive size
10.7 KB
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned
05Platforms
06Labels