Weekly SSL certificate expiration alerts across your domains
Scan every internet-facing service on your domains each week, catch SSL certificates expiring in the next 30 days, and get the prioritized list in Slack and email.
Censys
Slack Bot
GmailEngineeringOperationsResearch & MonitoringNotifications & AlertsAI ReportsEvery Monday at 7am, scan the internet-facing services running on my organization's domains, inspect the TLS certificate each service presents, and flag any certificate that will expire within the next 30 days. Treat this as an early-warning check so the team can renew certificates before they lapse and cause an outage.
Make the target domains and the expiry window user-editable. Default the expiry window to 30 days, and let me maintain the list of domains to watch, the Slack channel to post to, and the ops team email addresses that should receive the report. This runs on a schedule only, because Censys is a read-only data source rather than something that pushes events.
First, use the Censys 'Run a Search Query' action to pull the internet-facing services on each of my domains. The Censys Platform host records include the TLS certificate presented on each service along with its validity window, so read the presented certificate details directly from the service search results instead of running a separate certificate lookup. Note that the Censys connection needs the Organization ID set for these searches to run.
For each service, read the certificate's expiration date and calculate how many days remain until it expires. Skip any certificate that has already expired so the list only shows what still needs renewing. Keep only the certificates that expire within the configured window (30 days by default). Group the remaining findings by domain, and for each one list the hostname, the certificate issuer, and the number of days remaining. Sort the results so the most urgent certificates, meaning the fewest days remaining, come first.
Post the grouped summary to my infrastructure Slack channel using the Slack 'Send a Message' action, posting as the workspace bot. Format it clearly with each domain as a heading and the most urgent certificates at the top so the team can scan it quickly. If nothing is expiring within the window, post a short all-clear message so the team knows the check ran.
Then email the same report to the ops team. Use Gmail 'Create a Draft' to compose the email with the grouped, prioritized list, then use Gmail 'Send a Draft' to send it to the ops team recipients. Keep the email content consistent with the Slack summary.
Example output
Additional information
What does this prompt do?
- Scans the internet-facing services running on your domains every Monday morning and reads the security certificate each one presents.
- Flags any certificate expiring within the next 30 days, and skips ones that have already lapsed so the list only shows what still needs renewing.
- Groups the findings by domain and lists each hostname, who issued the certificate, and how many days are left, with the most urgent first.
- Posts the summary to your infrastructure Slack channel and emails the same report to your ops team.
What do I need to use this?
- A Censys account, including your Organization ID, to look up the services and certificates on your domains.
- A Slack workspace where the report can be posted to your infrastructure channel.
- A Gmail account to draft and send the report to your ops team.
- The list of domains you want to watch and the email addresses for your ops team.
How can I customize it?
- Change the expiry window (30 days by default) to get earlier or later warnings.
- Edit the list of domains you want scanned, plus the Slack channel and email recipients the report goes to.
- Adjust the schedule if Monday at 7am is not when your team starts the week.
Frequently asked questions
How far ahead does it warn me about expiring certificates?
Does it show certificates that have already expired?
Which of my domains does it check?
Where do the results go?
Will I hear anything if nothing is expiring soon?
Related templates
Never get surprised by an expired certificate again.
Set up this weekly check and let your team see expiring certificates in Slack and email before they cause an outage.