Certificates, operations and alerts
Track every TLS certificate your web servers serve, review the history of every operation run on them, and understand the web server alerts.
Certificates
Infrastructure > Certificates lists every TLS certificate the web servers serve, soonest to expire first: days left and expiry date, the domains, the server, the issuer, the source and the renewal state.
Filter by Issuer, Source, Renewal and Expiry. The source is one of:
- Issued by the suite: issued through certbot (or win-acme on Windows) by Tenvara, and renewed automatically from 30 days before expiry.
- Uploaded: pasted in on the site's Domains and TLS tab. Not renewed automatically.
- Other: found on the server, issued some other way. Renew it wherever it came from, or issue one from Tenvara.
The overview's Certificates tile and the 14 days view show those expiring within 14 days.
Operations
Everything run on a web server from Tenvara is an operation: creating a site, issuing a certificate, a deploy, a backup, reading a log, checking WordPress, restarting a service. Infrastructure > Web servers > Operations lists them all: when, what, the site, the server, the kind, who asked and how it went.
Click an operation to see its steps, its output (deploy scripts, certbot and wp-cli output is kept, up to 256 KB) and the error if it failed. An operation still waiting for the agent can be cancelled.
Each site's Operations tab and each server's Recent operations show the same history for that site or server.
Passwords the server generates (database, SFTP, basic authentication, WordPress) never appear in an operation. They are returned once, stored encrypted, and removed from the operation record.
Web server alerts
Web server alerts appear in Alerts with the source Infrastructure and follow your alert rules like any other alert.
| Alert | Severity | Raised when | Clears when |
|---|---|---|---|
| Certificate expiring | Warning within 14 days, critical within 3 days or expired | A certificate a site uses is close to expiry | It is renewed or no longer used |
| Certificate renewal failed | Warning, critical under 7 days left | Issuing or renewing failed | The next success |
| Site not answering | Critical | The site's primary domain has not answered in two reports in a row, for at least 5 minutes | It answers |
| Service stopped | Critical for the web server, PHP-FPM and the database; warning for others | A service is stopped or failed | It runs |
| Disk filling up | Warning over 85%, critical over 95% | A disk on the server is that full | Under 85% |
| Backup failed | Warning | A site's last backup failed | The next good backup |
| Backup missed | Warning | No good backup within twice the schedule's interval | A good backup |
| Site gone | Warning | A site Tenvara created is no longer in the server's reports | It is reported again, or deleted in Tenvara |
| Operation failed | Warning | An operation failed (not a cancelled one) | The same operation succeeds |
What Tenvara does not do on web servers
To keep the catalogue safe and predictable, some things are deliberately left out:
- DNS-01 and wildcard certificates are not offered: they need a DNS provider's credentials on the server.
- Apache sites are reported and checked, but not changed.
- Discovered sites are never changed; moving one into Tenvara's layout would be a migration, not an operation.
- Firewall rules and the host baseline (packages, fail2ban, unattended upgrades) are server set-up, done once by a script or through Run a command.
Was this page helpful?
Thanks for the feedback.