{
  "id": "monitor-certificates",
  "title": "Monitor certificates",
  "url": "https://redis.io/docs/latest/operate/rs/7.8/security/certificates/monitor-certificates/",
  "summary": "Monitor certificates on a Redis Enterprise cluster.",
  "content": "\nYou can monitor certificates used by Redis Enterprise Software.\n\n### Monitor certificates with Prometheus\n\nRedis Enterprise Software exposes the expiration time (in seconds) of each certificate on each node. To learn how to monitor Redis Enterprise Software metrics using Prometheus, see the [Prometheus integration quick start]().\n\nHere are some examples of the `node_cert_expiration_seconds` metric:\n\n```sh\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"cm\",node=\"1\",path=\"/etc/opt/redislabs/cm_cert.pem\"} 31104000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"api\",node=\"1\",path=\"/etc/opt/redislabs/api_cert.pem\"} 31104000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"proxy\",node=\"1\",path=\"/etc/opt/redislabs/proxy_cert.pem\"} 31104000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"metrics_exporter\",node=\"1\",path=\"/etc/opt/redislabs/metrics_exporter_cert.pem\"} 31104000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"syncer\",node=\"1\",path=\"/etc/opt/redislabs/syncer_cert.pem\"} 31104000.0\n```\n\nThe following certificates relate to [internode communication TLS encryption]() and are automatically rotated by Redis Enterprise Software:\n\n```sh\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"ccs_internode_encryption\",node=\"1\",path=\"/etc/opt/redislabs/ccs_internode_encryption_cert.pem\"} 2592000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"data_internode_encryption\",node=\"1\",path=\"/etc/opt/redislabs/data_internode_encryption_cert.pem\"} 2592000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"mesh_ca_signed\",node=\"1\",path=\"/etc/opt/redislabs/mesh_ca_signed_cert.pem\"} 2592000.0\nnode_cert_expiration_seconds{cluster=\"mycluster.local\",logical_name=\"gossip_ca_signed\",node=\"1\",path=\"/etc/opt/redislabs/gossip_ca_signed_cert.pem\"} 2592000.0\n```\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-04-01T08:10:08-05:00"
}