A renewed certificate in inventory means nothing if two backend nodes still serve the old PEM. CertLocker endpoint probes check live TLS on your hostnames, recognise PQ-ready MTC and ML-DSA material, and alert when reality diverges from policy.
Probes sit in the same control plane as certificate lifecycle and delivery: issue, ship, then verify before an expiry or mismatch becomes an outage — including dual classical and post-quantum bundles during the MTC transition.
See also post-quantum certificate operations, certificate rotation best practices, and the platform overview.