Keep an eye on your certificates
Copy link to the page “Keep an eye on your certificates”Get notified before a certificate expires and see which servers need attention.
What you need
Copy link to the section “What you need”- An email address someone monitors.
- Permission to create recipients and alert rules, at least the Operator role.
Create a recipient
Copy link to the section “Create a recipient”Use E-mail (Cloud) for the first notification setup. Messages go through sslbrain Cloud (EU) to the recipient list in Cloud. A separate list for the appliance takes precedence over the account list. If both are empty, messages go to the account owner.
- Open Notifications › Recipients and select E-mail (Cloud) as Channel type.
- Enter Channel name and an email address in the recipient field, then click Create channel. The recipient field must be filled in, but Cloud uses its recipient list.
- Click Send test next to the channel and check that the email arrives.
Choose when to be notified
Copy link to the section “Choose when to be notified”An alert rule selects the events you are notified about. Email is grouped into a scheduled summary; serious incidents can be sent immediately. Alert rules change no certificates or installation plans.
- Open Notifications › When and click New notification.
- Enter Name, select Certificate expiring as Event and select the channel under Channel.
- Set Threshold (days) to 30 and click Save.
Check that it works
Copy link to the section “Check that it works”The channel appears under Existing channels, the test email has arrived and the alert rule is enabled. Alert rules are checked hourly. Also create notifications for Renewal failed and Deployment failed so you can act before expiry.
If it fails
Copy link to the section “If it fails”- Create a notification channel first → create the recipient before creating the alert rule.
- The test email does not arrive → check the recipient list in Cloud and the connection to sslbrain Cloud.
- Requires … plan next to a channel type → use a type your licence covers, see Recipients by licence.
- A webhook or chat returns an error → correct the recipient’s address or key and use Send test again.
See what needs attention
Copy link to the section “See what needs attention”Overview shows servers, automated certificates, certificates expiring within 30 days and errors. Click a number to open the list. Create installation plans automatically shows suggestions for certificates that are not automated.
Go from the problem to the next action
Copy link to the section “Go from the problem to the next action”Open the item under Overview › Needs action and follow the status box’s action on the certificate, installation plan or server. Offline servers are also available with Offline under Servers › All servers. The Overview list is independent of alert rules.
Certificates in sslbrain
Copy link to the section “Certificates in sslbrain”Open Certificates › Certificates:
- Automated shows certificates sslbrain issues and certificates installed by an installation plan.
- Not automated shows certificates on servers that no installation plan renews and valid certificates found without a link to a managed certificate.
- History shows expired and replaced certificates without a link to a managed certificate.
Open a certificate. Status shows the problem and next action. For managed certificates, Versions shows issuances, validity and downloads. Used on shows servers, services and the installation plans using the certificate. Details shows the certificate’s information.
Expired and replaced certificates
Copy link to the section “Expired and replaced certificates”A discovered certificate under History that no installation plan manages does not by itself become a Needs action item. Always check the certificate the service actually presents. Discovered TLS ports are checked again nightly, see Certificates found on servers.
See how it connects
Copy link to the section “See how it connects”Installation plans › Connections shows the certificate source, certificate, installation plan and servers. Expand the flow and open an object to change it.
Recipients by licence
Copy link to the section “Recipients by licence”| Channel type | Licence | Sent |
|---|---|---|
| E-mail (Cloud) | Free and above | Via sslbrain Cloud |
| E-mail (SMTP), Webhook | Basic and above | Directly from the appliance |
| Slack, Microsoft Teams, Telegram | Professional and above | Via sslbrain Cloud |
| PagerDuty, OpsGenie | Enterprise | Via sslbrain Cloud |
Use SMTP or a webhook if messages must be sent without a Cloud connection. Chat and on-call settings are stored encrypted on the appliance and sent with the message; Cloud does not store them.