Why Most SSL Certificate Monitors Are Blind (And How to Fix It)

Thu, 19 Feb 2026 00:00:00 +0000

Google “golang check ssl certificate” and every example looks like this:

conn, _ := tls.Dial("tcp", "example.com:443",
 &tls.Config{InsecureSkipVerify: true})
cert := conn.ConnectionState().PeerCertificates[0]
fmt.Println(cert.NotAfter) // 2026-03-16

53 days left. Great. Ship it.

But your monitor just became blind to 3 out of 4 certificate problems.

The InsecureSkipVerify trap

InsecureSkipVerify: true skips all certificate validation - expiry, trust chain, hostname match. The connection is still encrypted, but Go won’t check if the cert is actually valid.

Why do examples use it? Without it, Go refuses to connect if anything is wrong. You get an error instead of certificate details. For a quick script, that’s inconvenient.

SSL on Upsonar Blog

Why Most SSL Certificate Monitors Are Blind (And How to Fix It)

The InsecureSkipVerify trap