Nova Ssl Card Laravel Package

Getting Started

Install via Composer from your Nova project root:

composer require marianvlad/nova-ssl-card

The package ships a pre-built Vue card component, so no npm/yarn build step is required in most setups. If assets don't appear, publish them:

php artisan vendor:publish --tag=nova-ssl-card-assets

Register the card in app/Providers/NovaServiceProvider.php. Add it to the cards() method (dashboard) or to a specific resource's cards() method:

public function cards()
{
    return [
        new \Marianvlad\NovaSslCard\NovaSslCard('example.com'),
    ];
}

Open the package's src/ directory first — the card's constructor signature and any options (domain vs. full URL, port, timeout) are the single most important thing to confirm, since the README is thin. Look at src/NovaSslCard.php and its component property, then open the matching Vue file in resources/js to see exactly which fields are rendered (issuer, valid-from, valid-to, days remaining).

Your first practical use case: pin one card per production domain on the Nova dashboard so anyone with Nova access sees certificate expiry at a glance.

Implementation Patterns

Dashboard monitoring for a small set of domains. The most common pattern is a fixed list of the domains you own:

public function cards()
{
    return [
        (new NovaSslCard('app.example.com'))->width('1/3'),
        (new NovaSslCard('api.example.com'))->width('1/3'),
        (new NovaSslCard('docs.example.com'))->width('1/3'),
    ];
}

Use Nova's width() helper to lay several cards side by side.

Per-resource card. To show SSL info for whatever URL a model stores, register the card inside the resource's cards() method and pass the model attribute. Because the card's constructor likely accepts a static value, the safest pattern is to resolve the URL in cards(Request $request):

public function cards(Request $request)
{
    return [
        new NovaSslCard($this->resource->domain),
    ];
}

Environment-aware configuration. Don't hardcode domains — pull them from config('app.domains') or an env var so staging and production see different targets:

collect(config('monitoring.domains'))
    ->map(fn ($d) => new NovaSslCard($d))
    ->all();

Pair with alerting. This card is read-only and passive — it only shows status when someone opens Nova. Combine it with a scheduled openssl s_client check or an uptime service if you need actual paging on expiry.

Gotchas and Tips

• Abandoned since 2018. Last release was August 2018 (Nova 1.x era). On Nova 4/5 the compiled Vue component may fail to register, tools/assets may 404, or the card may render blank. Test on a staging Nova install before trusting it in production. If it breaks, forking and rebuilding the Vue component against the current Nova asset pipeline is usually faster than waiting for upstream.
• Every dashboard load hits the remote host. The card checks the certificate server-side on each render. Slow or unreachable hosts will slow the dashboard, and firewalled instances will show stale or error states. If the package exposes a timeout option, set it low; otherwise cache results yourself (e.g. a scheduled command writing expiry into a config/cache key).
• Remote fetch requires PHP extensions and outbound access. It typically relies on openssl and/or curl. Verify allow_url_fopen/cURL and that the Nova host can reach each domain on port 443 — a card showing "error" is often a network policy issue, not an expired cert.
• Self-signed, SNI, and chain quirks. Self-signed certs, incomplete intermediate chains, and hosts requiring SNI can fail validation even though browsers accept them. Confirm the package's stream context / cURL options before blaming the card.
• Class and namespace naming. The class name (NovaSslCard, SslCard, etc.) and namespace differ between forks and versions. Always check src/ and composer.json autoload rather than copy-pasting from a blog post.
• Timezone on valid_to. Expiry timestamps come back in UTC from the certificate; if the card formats them, they'll render in whatever timezone the server or browser uses. A cert that "expires tomorrow" may already be past expiry in your local zone — check the raw value when debugging.
• No built-in caching or alerts. Treat this as a visibility tool only. The real safety net is a cron job or uptime monitor; the card is a nice dashboard garnish.