How do I filter certificates that have expired or are about to expire (Expiry Health)?

Short answer

In the Expiry Health card in the filter strip of the Certificates & PKI → SSL/TLS Certificates list, Expired, Expiring Soon (30 days or less remaining) and Valid are selected; if there is a record with no content yet, No Certificate also appears. More than one value can be selected together. The Valid Until column shows the expiry date with a colored status dot and the remaining time, and is sorted by clicking its header. The Certificate selector in the vService form also has the same Expiry Health filter. To receive a warning before the expiry, Certificate Expiry Notify Days in the Notifications profile is used.

Problem: Certificates Approaching Expiry Are Overlooked

In environments where many certificates are managed, the ones about to expire are easily overlooked; an expired certificate causes users to see a security warning and the service to be effectively interrupted. The certificates approaching expiry need to be seen at a glance.

Solution: Four Methods

Your situation	Suitable method
Filtering the list by expiry status	Method 1: Expiry Health filter
Sorting by remaining time	Method 2: Valid Until column
While selecting a certificate for the vService	Method 3: Filter in the Certificate selector
Being notified before the expiry	Method 4: Notification

Method 1: Expiry Health Filter Recommended

• How it works Certificates are classified by remaining time: Expired if past expiry, Expiring Soon if 30 days or less remain, Valid for the others; records with no content yet (e.g. an incomplete ACME.SH request) are No Certificate. In the card, each value is listed as a colored label that shows the number of certificates in that status.
• Where it is openedCertificates & PKI → SSL/TLS Certificates → Filter → Expiry Health
• Requirement None
• vService type All

Step-by-Step Configuration

1

Adım 1 Open the certificate list

The Configuration Menu is opened with the TR7 logo at the bottom left; the Certificates & PKI → SSL/TLS Certificates screen is opened; the certificate list is displayed in the first tab, with the menu path written in its header.

2

Adım 2 Apply the filter

In the filter strip opened with the Filter button on the toolbar, the Expiring Soon and Expired labels are clicked in the Expiry Health card. The list can also be narrowed down by certificate type with the Type card in the same strip. The 30-day threshold is fixed.

Verification

1Filtered listSSL/TLS Certificates list

The list shows only the certificates that have expired and that are about to expire; the status dots in the Valid Until column are in the error or warning color.

ExpectedExpired · Expiring Soon

Method 2: Valid Until Column

• How it works The column shows the expiry date of the certificate with a colored status dot and the remaining time (e.g. 12d, 8mo, 3y); for an expired certificate, Expired is written instead of the remaining time.
• Where it is openedCertificates & PKI → SSL/TLS Certificates → Valid Until column
• Requirement None
• vService type All

Step-by-Step Configuration

1

Adım 1 Open the certificate list

The Certificates & PKI → SSL/TLS Certificates screen is opened (listing screen).

2

Adım 2 Sort

The Valid Until column header is clicked: the first click applies descending order, the second click applies ascending order, and the third click removes the sorting. To see the certificates with the nearest expiry at the top, the header is clicked twice.

Verification

1Sorted listSSL/TLS Certificates list

In ascending order, the certificates with the nearest expiry date appear at the top; when the cursor is held over the remaining time, the remaining time is shown in days.

ExpectedThe one with the least remaining time at the top

Method 3: Filter in the Certificate Selector

• How it works The Certificate selector in the vService form has the same Type, Expiry Health and Used in filters as the certificate list; before a selection is made, the certificates that have expired or are about to expire are distinguished. The filter only narrows the list; it does not prevent the selection.
• Where it is opened vService → Edit → Certificate selector → Expiry Health
• Requirement An encrypted frontend row on the vService
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

2

Adım 2 Open the selector

The Certificate field is clicked. The field is shared by all the frontend rows and is visible while an encrypted protocol is selected in at least one row.

3

Adım 3 Filter

In the Expiry Health filter at the top of the selector, Valid is selected; the list narrows down to only the certificates with more than 30 days remaining.

Verification

1OptionsvService form

Only the certificates in the selected status remain in the selector.

ExpectedValid certificates

Method 4: Notification

• How it works When the remaining time reaches the number of days in the Notifications profile, a warning is generated for the certificates bound to the vServices the profile is assigned to.
• Where it is openedLoad Balancer → Profiles → Notifications · vService → Details → Frontend Settings → Notification
• Requirement At least one channel in the profile for the warning to go out (details: How do I get a warning before a certificate expires?)
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the profile form

On the Load Balancer → Profiles → Notifications screen, Add is clicked (how to add).

2

Adım 2 Set the number of days and the channel

Notification Profile Name is entered; the Certificate Expiry Notify Days field opens with 30 and is changed if necessary. The channel the warning will go to (e.g. E-mail) is turned on.

3

Adım 3 Save the profile

Add is clicked.

4

Adım 4 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

5

Adım 5 Select the profile

In the Details panel, the Notification box under Frontend Settings is checked; in the selector, the profile from step 3 is selected instead of Default Profile (how to add to a vService).

6

Adım 6 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1NotificationNotification Logs

Certificates are checked every 3 hours and whenever the configuration changes. On the Settings → System Logs → Notification Logs screen, a time range is selected and Get Logs is clicked.

ExpectedNotification record for the certificate approaching expiry

Common Mistakes

• Trying to change the Expiring Soon threshold. The 30-day threshold is fixed; for a different warning period, the number of days in the Notifications profile is used.
• Confusing three separate thresholds. Expiry Health (fixed 30 days), the notification day count (per profile) and the ACME.SH automatic renewal period (per certificate record) are independent of each other.
• Assuming the notification covers all certificates. The notification is generated only for the certificates bound to the vServices the profile is assigned to; the certificates not used in any vService are monitored with the Expiry Health filter.

How it is done in the documentation

• SSL/TLS Certificates · Filter
• SSL/TLS Certificates · The SSL/TLS Certificates Listing Screen
• Alert Notifications · Certificate Expiry Notify Days

Related questions

• How do I get a warning before a certificate expires?
• When I renew a certificate, do I need to replace it on each vService one by one?
• Can I get certificates automatically with Let's Encrypt / ACME?