What it does
- Scans the internet-facing services running on your domains every Monday morning and reads the security certificate each one presents.
- Flags any certificate expiring within the next 30 days, and skips ones that have already lapsed so the list only shows what still needs renewing.
- Groups the findings by domain and lists each hostname, who issued the certificate, and how many days are left, with the most urgent first.
- Posts the summary to your infrastructure Slack channel and emails the same report to your ops team.
The prompt
Paste it into a new chat in General Input, and a specialist builds it with you.
Every Monday at 7am, scan the internet-facing services running on my organization's domains, inspect the TLS certificate each service presents, and flag any certificate that will expire within the next 30 days. Treat this as an early-warning check so the team can renew certificates before they lapse and cause an outage.
Make the target domains and the expiry window user-editable. Default the expiry window to 30 days, and let me maintain the list of domains to watch, the Slack channel to post to, and the ops team email addresses that should receive the report. This runs on a schedule only, because Censys is a read-only data source rather than something that pushes events.
First, use the Censys 'Run a Search Query' action to pull the internet-facing services on each of my domains. The Censys Platform host records include the TLS certificate presented on each service along with its validity window, so read the presented certificate details directly from the service search results instead of running a separate certificate lookup. Note that the Censys connection needs the Organization ID set for these searches to run.
For each service, read the certificate's expiration date and calculate how many days remain until it expires. Skip any certificate that has already expired so the list only shows what still needs renewing. Keep only the certificates that expire within the configured window (30 days by default). Group the remaining findings by domain, and for each one list the hostname, the certificate issuer, and the number of days remaining. Sort the results so the most urgent certificates, meaning the fewest days remaining, come first.
Post the grouped summary to my infrastructure Slack channel using the Slack 'Send a Message' action, posting as the workspace bot. Format it clearly with each domain as a heading and the most urgent certificates at the top so the team can scan it quickly. If nothing is expiring within the window, post a short all-clear message so the team knows the check ran.
Then email the same report to the ops team. Use Gmail 'Create a Draft' to compose the email with the grouped, prioritized list, then use Gmail 'Send a Draft' to send it to the ops team recipients. Keep the email content consistent with the Slack summary.
What you'll need
- A Censys account, including your Organization ID, to look up the services and certificates on your domains.
- A Slack workspace where the report can be posted to your infrastructure channel.
- A Gmail account to draft and send the report to your ops team.
- The list of domains you want to watch and the email addresses for your ops team.
Make it yours
- Change the expiry window (30 days by default) to get earlier or later warnings.
- Edit the list of domains you want scanned, plus the Slack channel and email recipients the report goes to.
- Adjust the schedule if Monday at 7am is not when your team starts the week.