Test Optimization
Guidance for getting the most signal out of your tests — enhanced SSL checks, sensible intervals, alert rules and retention.
Enhanced SSL checks
SSL tests collect far more than certificate expiry. With defaults on, every SSL test records:
| Capability | Where it is recorded | Config keys |
|---|---|---|
| Certificate expiry | days_left, last_expiry | warning_days, critical_days |
| Handshake time | details.handshake_ms | config.timeout |
| TLS version | details.tls_version | config.tls_min_version ("1.2" / "1.3") |
| Cipher | details.cipher | — |
| Issuer validation | status → invalid on mismatch | config.require_issuer |
| OCSP revocation | details.ocsp_status (good / revoked / unknown / error) | config.check_ocsp (default true) |
| Certificate Transparency | details.ct_status (present / absent) | config.check_ct (default true) |
Because check_ocsp and check_ct default to true, existing SSL tests
collect the enhanced data automatically. require_issuer and tls_min_version are
opt-in (useful for compliance-driven checks).
Severity ladder — the default warning_days / critical_days are 30 / 7. To add an "Info at 60 days" tier, set warning_days = 60 on the relevant tests
(or add an alert rule on status valid with warning_days = 60).
Common findings
- Coverage gaps — fleets are often SSL/DNS heavy; adopt HTTP and gRPC tests for API endpoints.
- Redundant monitoring — multiple SSL tests on the same (host, port) add cost without new signal. Consolidate to one test per (host, port) unless team separation requires duplicates.
- Alert noise — tests without explicit alert rules fall back to one alert per status change. Convert them to explicit rules with dedup.
- Retention — tests default to 30 days; raise per-test
retention_daysfor critical endpoints (90d critical, 30d default, 7d ephemeral).
Prioritized action items
| Priority | Action |
|---|---|
| Critical | Add alert rules to every test still on the auto-alert fallback; fix failing tests. |
| High | Standardize intervals: critical 1–2 min, standard 5 min, batch 15–60 min; consolidate duplicate SSL tests. |
| Medium | Set retention_days (90/30/7); add tags like production, critical for filtering. |
| Low | Adopt HTTP tests with body assertions for APIs; use tls_min_version / require_issuer for compliance. |
Recommendations per test type
| Type | Recommendation |
|---|---|
| SSL / TLS Expiry | Keep expiry monitoring; enable OCSP + CT (default on). Add handshake / TLS-version checks for compliance. |
| DNS | Use expected answers to turn "resolves" into "resolves to the right IPs". |
| HTTP | Assert status code + body content + timing (response_time_ms); monitor from multiple locations. |
| gRPC | Health checks for every service; unary calls for critical RPCs with protobuf descriptors. |
Biggest quick win
Retention cleanup (daily job) is the biggest database win — set sensible
retention_days so
tables stop growing unboundedly.