{
  "schema_version": 2,
  "id": "operate/rs/security/certificates/monitor-certificates",
  "title": "Monitor certificates",
  "url": "https://redis.io/docs/latest/operate/rs/8.0/security/certificates/monitor-certificates/",
  "summary": "Monitor certificates on a Redis Software cluster.",
  "content": "\nRedis Software exposes the expiration time in seconds of each certificate on each node. You can use Prometheus to monitor these certificates.\n\nTo learn how to monitor Redis Software metrics using Prometheus, see [Monitoring with metrics and alerts](https://redis.io/docs/latest/operate/rs/monitoring) and the [Prometheus integration quick start](https://redis.io/docs/latest/integrate/prometheus-with-redis-enterprise).\n\n## V1 metrics\n\nThe [v1 metrics](https://redis.io/docs/latest/operate/rs/monitoring/v1_monitoring) endpoint (`https://\u003ccluster_name\u003e:8070/`) uses `node_cert_expiration_seconds`.\n\n### Certificate expiration in seconds {#v1-cert-expire-seconds}\n\n```sh\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"cm\",node=\"1\",path=\"/etc/opt/redislabs/cm_cert.pem\"} 31104000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"api\",node=\"1\",path=\"/etc/opt/redislabs/api_cert.pem\"} 31104000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"proxy\",node=\"1\",path=\"/etc/opt/redislabs/proxy_cert.pem\"} 31104000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"metrics_exporter\",node=\"1\",path=\"/etc/opt/redislabs/metrics_exporter_cert.pem\"} 31104000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"syncer\",node=\"1\",path=\"/etc/opt/redislabs/syncer_cert.pem\"} 31104000.0\n```\n\nThe following certificates relate to [internode communication TLS encryption](https://redis.io/docs/latest/operate/rs/security/encryption/internode-encryption) and are automatically rotated by Redis Software:\n\n```sh\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"ccs_internode_encryption\",node=\"1\",path=\"/etc/opt/redislabs/ccs_internode_encryption_cert.pem\"} 2592000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"data_internode_encryption\",node=\"1\",path=\"/etc/opt/redislabs/data_internode_encryption_cert.pem\"} 2592000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"mesh_ca_signed\",node=\"1\",path=\"/etc/opt/redislabs/mesh_ca_signed_cert.pem\"} 2592000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"gossip_ca_signed\",node=\"1\",path=\"/etc/opt/redislabs/gossip_ca_signed_cert.pem\"} 2592000.0\n```\n\n## V2 metrics\n\nThe [v2 metrics](https://redis.io/docs/latest/operate/rs/monitoring/metrics_stream_engine) endpoint (`https://\u003ccluster_name\u003e:8070/v2`) uses `node_cert_expires_in_seconds`.\n\n### Certificate expiration in seconds {#v2-cert-expire-seconds}\n\n```sh\nnode_cert_expires_in_seconds{cluster=\"mycluster.local\",logical_name=\"cm\",node=\"1\",path=\"/etc/opt/redislabs/cm_cert.pem\"} 31104000.0\nnode_cert_expires_in_seconds{cluster=\"mycluster.local\",logical_name=\"api\",node=\"1\",path=\"/etc/opt/redislabs/api_cert.pem\"} 31104000.0\nnode_cert_expires_in_seconds{cluster=\"mycluster.local\",logical_name=\"proxy\",node=\"1\",path=\"/etc/opt/redislabs/proxy_cert.pem\"} 31104000.0\nnode_cert_expires_in_seconds{cluster=\"mycluster.local\",logical_name=\"metrics_exporter\",node=\"1\",path=\"/etc/opt/redislabs/metrics_exporter_cert.pem\"} 31104000.0\nnode_cert_expires_in_seconds{cluster=\"mycluster.local\",logical_name=\"syncer\",node=\"1\",path=\"/etc/opt/redislabs/syncer_cert.pem\"} 31104000.0\n```\n\nThe following certificates relate to [internode communication TLS encryption](https://redis.io/docs/latest/operate/rs/security/encryption/internode-encryption) and are automatically rotated by Redis Software:\n\n```sh\nnode_cert_expires_in_seconds{cluster=\"mycluster.local\",logical_name=\"ccs_internode_encryption\",node=\"1\",path=\"/etc/opt/redislabs/ccs_internode_encryption_cert.pem\"} 2592000.0\nnode_cert_expires_in_seconds{cluster=\"mycluster.local\",logical_name=\"data_internode_encryption\",node=\"1\",path=\"/etc/opt/redislabs/data_internode_encryption_cert.pem\"} 2592000.0\nnode_cert_expires_in_seconds{cluster=\"mycluster.local\",logical_name=\"mesh_ca_signed\",node=\"1\",path=\"/etc/opt/redislabs/mesh_ca_signed_cert.pem\"} 2592000.0\nnode_cert_expires_in_seconds{cluster=\"mycluster.local\",logical_name=\"gossip_ca_signed\",node=\"1\",path=\"/etc/opt/redislabs/gossip_ca_signed_cert.pem\"} 2592000.0\n```\n\n### Certificate expiration in days {#v2-cert-expire-days}\n\n```sh\nmax by(filename) (\n  max_over_time(node_cert_expires_in_seconds{cluster=\"$cluster\", filename=~\"api_cert.pem|cm_cert.pem|metrics_exporter_cert.pem|proxy_cert.pem|syncer_cert.pem|trusted_ca.pem\"}[5m])\n) / 86400\n```\n\nThe following certificates relate to [internode communication TLS encryption](https://redis.io/docs/latest/operate/rs/security/encryption/internode-encryption) and are automatically rotated by Redis Software:\n\n```sh\nmax by(filename) (\n  max_over_time(node_cert_expires_in_seconds{cluster=\"$cluster\", filename=~\"ccs_internode_encryption_cert.pem|data_internode_encryption_cert.pem|mesh_ca_signed_cert.pem|gossip_ca_signed_cert.pem\"}[5m])\n) / 86400\n```\n\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-10-21T09:46:20-07:00"
}