Network - Custom URL Status

Monitoring Benefit

The Custom URL network status test is offered by the Microsoft 365 Remote Probes. It confirms that a server or endpoint is reachable, so you know it is available to end users, and it monitors the latency from the web server to that private or public endpoint.

The Custom URL test also monitors HTTPS status. It detects SSL/TLS certificate expiry — preventing outages caused by an invalid certificate — and identifies issues such as weak encryption or misconfiguration.

How do we verify the monitoring test results?

All three checks are verified from the ENow web server, because that is where the test runs from.

• Reachability — ping the HTTP or HTTPS endpoint from the ENow web server. Note that the endpoint must be configured to respond to ping for this to be meaningful.
• Latency — run a tracert from the ENow web server to the endpoint, which also shows you where in the path the delay is introduced.
• Certificate — use Invoke-WebRequest in PowerShell, as below.

Check a certificate by hand

# Define the URL of the HTTPS endpoint
$url = "https://example.com"

# Perform the web request and capture the response
$response = Invoke-WebRequest -Uri $url -UseBasicParsing

# Extract the certificate details from the response
$certificate = $response.BaseResponse.ServicePoint.Certificate

# Display the certificate information
[PSCustomObject]@{
    Subject        = $certificate.Subject
    Issuer         = $certificate.Issuer
    ExpirationDate = $certificate.GetExpirationDateString()
    EffectiveDate  = $certificate.GetEffectiveDateString()
    Thumbprint     = $certificate.GetCertHashString()
    Protocol       = $response.BaseResponse.ServicePoint.ProtocolVersion
}

Run this in Windows PowerShell 5.1. The ServicePoint property it relies on is not available in PowerShell 7 and later, so the certificate and protocol lines will return nothing there.

Compare the expiry date returned here against what the test reports. If they agree, the certificate really is close to expiry or expired. If they disagree, the endpoint is likely serving different certificates from different nodes behind a load balancer — run the check several times and see whether the thumbprint changes.