SSL/TLS Certificate, DNS CAA & Domain Expiration Watchdog

2. Four TLS & DNS Authority Guardrails (Cloudflare Edge Universal SSL + Origin Strict TLS)

• 1. Multi-Stage Expiry Escalation (30d / 14d / 7d / 48h): Alerts well before a failed auto-renewal (Origin server certificate expiration causing Cloudflare HTTP 526 Invalid SSL Certificate outage despite green Edge status) triggers a browser NET::ERR_CERT_DATE_INVALID block.
• 2. Full Intermediate Chain & TLS 1.3 Handshake Check: Verifies the complete certificate chain across all 5 endpoints so mobile browsers never fail on missing intermediate CA bundles.
• 3. DNS CAA & Authoritative Record Drift Guard: Monitors your DNS CAA policy and A/CNAME records to catch accidental DNS edits or unauthorized certificate issuance.
• 4. HTTPS Redirect & HSTS Enforcement Assertion: Confirms http://apexclimate.com 301-redirects cleanly to https://apexclimate.com with Strict-Transport-Security enabled.

apexclimate.com.  3600  IN  CAA  0 issue "letsencrypt.org; issue "pki.goog"; issue "ssl.com""
apexclimate.com.  3600  IN  CAA  0 issuewild "letsencrypt.org; issue "pki.goog"; issue "ssl.com""
apexclimate.com.  3600  IN  CAA  0 iodef "mailto:security@apexclimate.com"

# 1. Inspect Live TLS 1.3 Handshake, Issuer & Expiration Date for apexclimate.com
echo | openssl s_client -servername apexclimate.com -connect apexclimate.com:443 2>/dev/null \
  | openssl x509 -noout -issuer -subject -dates

# 2. Verify DNS CAA Authorization & A/AAAA Resolution
dig +short CAA apexclimate.com
dig +short A apexclimate.com

{
  "watchdog_id": "tls_dns_guard_apexclimate.com",
  "provider": "cloudflare",
  "root_domain": "apexclimate.com",
  "monitored_subdomains_count": 4,
  "tls_assertions": {
    "min_protocol": "TLSv1.2",
    "require_full_chain": true,
    "alert_days_remaining": [30, 14, 7, 2]
  },
  "dns_assertions": {
    "verify_caa_issuer": "letsencrypt.org; issue "pki.goog"; issue "ssl.com"",
    "alert_on_a_record_drift": true
  }
}