How do I get a warning before a certificate expires?

Short answer

A Notifications profile is assigned to the vService; when as many days remain as the Certificate Expiry Notify Days value in the profile (in the interface, a new profile opens with 30), a warning is generated for every certificate bound to the vService. The certificates are checked every 3 hours, and the warning is repeated every day at 13:30 as long as the condition continues. For the warning to arrive as an e-mail, SMS, SNMP trap or UI notification, a channel must be enabled in the profile; if no channel is enabled, the warning is written only to the Notification Logs screen. To monitor without setting up notifications, the Expiry Health filter in the certificate list is used.

Problem: The Certificate Expiry Is Learned from the Users

When a certificate expires, browsers show a security warning and users effectively cannot access the site. For the renewal to be done on time, the administrators must be notified in advance when the expiry date approaches. Although certificates obtained with ACME renew themselves, the renewal can fail, so the expiry warning is useful for them as well.

Solution: Three Methods

Methods 1 and 2 set up the same warning from the interface or from the command line; Method 3 does not send notifications, it filters the list.

Your situation	Suitable method
Receiving an e-mail, SMS, SNMP trap or UI notification	Method 1: Notifications profile
Creating the profile and the assignment from the command line	Method 2: WEB-CLI
Seeing the certificates whose expiry is approaching in the list without setting up notifications	Method 3: Expiry Health filter

Method 1: Notifications Profile Recommended

• How it works The remaining validity of every certificate bound to the vService to which the profile is assigned is calculated every 3 hours and on every configuration change; when the remaining days drop to the threshold, a warning is generated, and when the certificate expires, a second warning arrives.
• Where it is openedLoad Balancer → Profiles → Notifications · vService → Details → Frontend Settings → Notification
• Requirement SMTP for e-mail, the trap target setting for SNMP trap (Settings → General Settings → Notification Management)
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Configure the e-mail and SNMP settings (if needed)

If the e-mail channel will be used, the SMTP server is defined in the E-mail Settings section of the Settings → General Settings → Notification Management screen and tried with a test message; if SNMP trap will be used, the trap target is defined in the SNMP Settings section of the same screen. If only UI notification will be used, this step is skipped.

2

Adım 2 Open the profile form

On the Load Balancer → Profiles → Notifications screen, Add is clicked (how to add). The form opens filled in with the values of the default profile.

3

Adım 3 Enter the name and the threshold

The Notification Profile Name is entered. The Certificate Expiry Notify Days field comes with 30; the number of days before expiry at which the warning will start is written. If the field is left empty or 0 is written, this profile does not generate certificate warnings. The Backend Service Status, vService Status and traffic thresholds in the form also come filled in; in a profile where only the certificate warning is wanted, these are turned off.

4

Adım 4 Select the channels

At least one of the notification channels is enabled: E-mail (one or more addresses), SMS (phone numbers), SNMP Trap or UI Notification. All the channels are off by default. If Mute Night Notifications is turned on, only SMS is not sent between 22:00–08:00.

5

Adım 5 Save the profile

Add is clicked; the profile is added to the list.

6

Adım 6 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

7

Adım 7 Add the profile to the vService

In the Details panel, the Notification box under Frontend Settings is checked. In the selector that opens, Default Profile comes selected; the profile from step 5 is selected (how to add to a vService). More than one profile can be selected together; with the add icon of the selector, a new profile can also be created without leaving the form.

8

Adım 8 Save

Save is clicked. When the configuration is saved, the certificates are checked immediately; for the certificates below the threshold, the warning is generated within a few minutes. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Warning recordTR7 side

For a test, the threshold is written larger than the number of days remaining on the certificate and saved. On the Settings → System Logs → Notification Logs screen, a time range is selected and Get Logs is clicked.

ExpectedExpiry warning with the vService and certificate name

If there is a record but no message arrives, a channel has not been enabled in the profile, or E-mail Settings / SNMP Settings is missing.

2MessageChannel side

The selected channel is checked: the e-mail inbox, SMS, the SNMP trap receiver or the notification panel of the interface.

ExpectedA certificate expiry warning is received

Method 2: WEB-CLI

• How it works The profile and the vService assignment are made from the command line. In a profile created with WEB-CLI, the fields do not come filled in as in the interface; if the number of days is not written explicitly, no certificate warning is generated.
• Where it is opened TR7 WEB-CLI → lb notification add · lb service update
• Requirement WEB-CLI access; E-mail Settings for e-mail
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Create the profile

The profile is added by giving the number of days and the e-mail address (lb notification):

lb notification add name sertifika-uyari --notifyDaysBeforeCertificateExpiry 30 --email.0 ops@example.com

A second address is added with --email.1, an SMS number with --sms.0, SNMP trap with --snmp true, and UI notification with --ui true.

2

Adım 2 View the current profile of the vService

lb service show <vService>

The notification line in the output shows the profile of the vService, and the extraNotificationProfiles lines show the additional profiles.

3

Adım 3 Assign the profile to the vService

If the vService has no profile, or if this profile is to replace the current profile:

lb service update id <vService> --notification sertifika-uyari

If the current profile is to be kept and this profile is to be bound in addition, --extraNotificationProfiles.N sertifika-uyari is written; N is the first empty position seen in step 2.

Verification

1RecordTR7 side

The profile and vService records are displayed.

Command: lb notification list · lb service show <vService>

ExpectednotifyDaysBeforeCertificateExpiry 30 · notification sertifika-uyari

That the warning is generated is followed on the Notification Logs screen, as in Method 1.

Method 3: Expiry Health Filter

• How it works The Expiry Health card in the certificate list counts and filters the records by the remaining validity: those with 30 days or less until expiry are colored as Expiring Soon, and expired ones as Expired. It does not send notifications.
• Where it is openedCertificates & PKI → SSL/TLS Certificates → Filter → Expiry Health
• Requirement None; certificates that are not bound to a vService are also listed
• Scope All certificate records

Step-by-Step Configuration

1

Adım 1 Open the certificate list

The Certificates & PKI → SSL/TLS Certificates screen is opened.

2

Adım 2 Open the filter strip

The Filter button on the toolbar is clicked.

3

Adım 3 Filter

In the Expiry Health card, Expiring Soon and Expired are selected. Details: How do I filter certificates that have expired or are about to expire (Expiry Health)?

Verification

1ListSSL/TLS Certificates

Only the certificates whose expiry is approaching and those that have expired remain in the table; the circle in the Valid Until column is orange or red.

ExpectedExpiring Soon · Expired

Common Mistakes

• Checking only the Notification box. When the box is checked, Default Profile comes selected; in this profile, the threshold is 30 days but all the channels are off, and the warning only goes to Notification Logs. A profile with a channel enabled is selected.
• Expecting warnings for certificates that are not bound to a vService. Only the certificates selected in the Certificate field of vServices are checked; the HTTPS certificate of the management interface, the client certificate presented on the Backend Service and CA records are out of scope. These are monitored with the Expiry Health filter.
• Not writing the number of days in WEB-CLI. In a profile created with WEB-CLI, Certificate Expiry Notify Days stays empty and no certificate warning is generated.
• Thinking that Mute Night Notifications silences all the channels. Only SMS is silenced between 22:00–08:00; e-mail, SNMP trap and UI notification continue to be sent.
• Not setting up a warning on the assumption that the ACME certificate renews itself. If DNS or port 80 access breaks, the renewal fails; the expiry warning catches this situation as well.

How it is done in the documentation

• Notifications · Certificate Expiry Notify Days
• Notifications · How to Add to a vService?
• Notification Logs · Notification Types
• Notification Management · E-mail Settings

Related questions

• How do I filter certificates that have expired or are about to expire (Expiry Health)?
• Can I get certificates automatically with Let's Encrypt / ACME?
• When I renew a certificate, do I need to replace it on each vService one by one?