Certificate Expiration Detection
Proactively tracks SSL/TLS certificate expiration dates and flags those approaching their end date
- Runs periodic scans across all configured domains and services
- Identifies certificates expiring within the configured threshold
- Distinguishes newly flagged certificates from those already being tracked
- Notifies the responsible owners and IT team through their preferred communication channel
- Opens a ticket for renewal with the relevant expiry details
- Auto-resolves once the certificate is successfully renewed
What Certificate Expiration Detection does
Certificate Expiration Detection is Harmony's scheduled monitor for SSL/TLS certificates running out of time. On a recurring schedule it scans every configured domain and service, compares each certificate's expiry date against a configurable threshold, and for anything inside that window it notifies the responsible owner and opens a renewal ticket with the expiry details. It tracks what it has already reported, so each run surfaces new certificates rather than repeating the same list, and it closes its own ticket once the renewal lands.
Who Certificate Expiration Detection is for
IT operations, platform, and security teams who own the certificates behind public sites, internal services, and API endpoints.
Certificate expiry is invisible until it isn't. Renewal dates live in someone's calendar, a spreadsheet, or nowhere at all, and the first sign of trouble is usually a browser warning on a customer-facing page or a service that quietly stops trusting its upstream. The renewal itself is trivial; noticing in time is the hard part.
How Certificate Expiration Detection works
A recurring schedule, configurable per tenant.
- Scan configured endpoints
Sweeps every domain and service in scope and reads the certificate each one presents, including its expiry date.
- Compare against the threshold
Flags every certificate whose expiry falls inside the configured warning window, so renewals surface with lead time rather than on the day.
- Separate new findings from tracked ones
Checks each flagged certificate against what earlier runs reported, so a renewal already in flight isn't raised again.
- Notify the owners
Alerts the responsible certificate owner and the IT team through each recipient's preferred channel.
- Open a renewal ticket
Creates a ticket carrying the certificate, the service it protects, and the exact expiry date, so whoever picks it up has what they need.
- Auto-resolve on renewal
Confirms the replacement on a later run and closes the ticket without anyone having to remember to.
Every certificate approaching expiry has a ticket, an owner, and a deadline well before it becomes an outage, and those tickets close themselves once the renewal is in place.
Capabilities
- Scheduled certificate sweeps - Checks every configured domain and service on a recurring schedule rather than on request.
- Configurable warning window - The days-before-expiry threshold is set per tenant, so the lead time matches how long your renewal process actually takes.
- Deduplicated findings - Distinguishes newly flagged certificates from ones already being tracked, so repeat runs don't repeat themselves.
- Owner-aware notifications - Routes each alert to the responsible owner and the IT team through their preferred channel.
- Renewal tickets with the details attached - Every ticket carries the certificate, the service behind it, and the expiry date.
- Automatic closure - Resolves its own ticket once the certificate has been successfully renewed.
Main use cases
Public site certificate about to lapse - The certificate on a customer-facing domain is three weeks from expiry. The agent flags it inside the warning window, tickets the renewal with the exact date, and notifies the owner, so the fix happens on a normal working day instead of during an incident.
Internal service trust chain - An internal API's certificate expires and downstream services stop trusting it, producing failures that look like anything but a certificate problem. Catching the expiry ahead of time means that class of outage never starts.
Evidence for a certificate hygiene review - A security review asks how certificate renewals are tracked. The agent's recurring tickets and closure records are the answer, without anyone assembling a spreadsheet after the fact.
Integrations
| Integration | Role in the agent flow |
|---|---|
| SolarWinds | Monitoring signal for the network services in scope |
| Qualys | Certificate and vulnerability scanning data for the hosts in scope |
| Harmony Service Desk | Native ticketing - creates the ticket, tracks it, and records the outcome |
| Harmony Notifications | Delivers updates through each recipient's preferred channel: Slack, Teams, or email |
FAQ
It runs on its own. Certificate Expiration Detection is a scheduled workflow inside Harmony: it wakes on its schedule, scans, and acts. There is no conversation to start.
Meet more Agents
