2 files changed, 30 insertions, 5 deletions
diff --git a/backend/internal/monitor/checker.go b/backend/internal/monitor/checker.go
index 07f807e..df386e6 100644
--- a/backend/internal/monitor/checker.go
+++ b/backend/internal/monitor/checker.go
@@ -12,14 +12,16 @@ import (
 
 var httpClient = &http.Client{
 	Timeout: 10 * time.Second,
+	// do NOT set InsecureSkipVerify — we want proper TLS
 }
 
-func CheckHTTP(ctx context.Context, url string, keyword string) model.Heartbeat {
+func CheckHTTP(ctx context.Context, url string, keyword string) (model.Heartbeat, *model.SSLInfo) {
 	start := time.Now()
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
-		return heartbeatFromError(start, err)
+		hb := heartbeatFromError(start, err)
+		return hb, nil
 	}
 
 	resp, err := httpClient.Do(req)
@@ -32,7 +34,7 @@ func CheckHTTP(ctx context.Context, url string, keyword string) model.Heartbeat
 			IsUp:           false,
 			ErrorMessage:   err.Error(),
 			TestedAt:       time.Now(),
-		}
+		}, nil
 	}
 	defer resp.Body.Close()
 
@@ -66,13 +68,29 @@ func CheckHTTP(ctx context.Context, url string, keyword string) model.Heartbeat
 		}
 	}
 
-	return model.Heartbeat{
+	hb := model.Heartbeat{
 		StatusCode:     resp.StatusCode,
 		ResponseTimeMs: elapsed,
 		IsUp:           isUp,
 		ErrorMessage:   errMsg,
 		TestedAt:       time.Now(),
 	}
+
+	// Extract TLS certificate info
+	var ssl *model.SSLInfo
+	if resp.TLS != nil && len(resp.TLS.PeerCertificates) > 0 {
+		cert := resp.TLS.PeerCertificates[0]
+		days := int(time.Until(cert.NotAfter).Hours() / 24)
+		ssl = &model.SSLInfo{
+			ServiceID:     0, // filled in by caller
+			Issuer:        cert.Issuer.CommonName,
+			ExpiresAt:     cert.NotAfter,
+			DaysRemaining: days,
+			CheckedAt:     time.Now(),
+		}
+	}
+
+	return hb, ssl
 }
 
 func heartbeatFromError(start time.Time, err error) model.Heartbeat {
diff --git a/backend/internal/monitor/worker.go b/backend/internal/monitor/worker.go
index 70855a2..34a5cba 100644
--- a/backend/internal/monitor/worker.go
+++ b/backend/internal/monitor/worker.go
@@ -166,9 +166,16 @@ func (w *Worker) checkService(ctx context.Context, svc model.Service) {
 	checkCtx, cancel := context.WithTimeout(ctx, w.timeout)
 	defer cancel()
 
-	hb := CheckHTTP(checkCtx, svc.URL, svc.KeywordToFind)
+	hb, ssl := CheckHTTP(checkCtx, svc.URL, svc.KeywordToFind)
 	hb.ServiceID = svc.ID
 
+	if ssl != nil {
+		ssl.ServiceID = svc.ID
+		if err := w.store.SaveSSLInfo(*ssl); err != nil {
+			log.Printf("[worker] erro ao salvar ssl info: %v", err)
+		}
+	}
+
 	w.results <- checkResult{Heartbeat: hb, Service: svc}
 }