A renewed certificate in inventory means nothing if two backend nodes still serve the old PEM. CertLocker endpoint probes check live TLS on your hostnames and alert when reality diverges from policy.
Probes sit in the same control plane as certificate lifecycle and delivery: issue, ship, then verify before an expiry or mismatch becomes an outage.
See also certificate rotation best practices and the platform overview.