# Certificate Expiration Detection

**Categories:** Software Management

Proactively tracks SSL/TLS certificate expiration dates and flags those approaching their end date

- Runs periodic scans across all configured domains and services
- Identifies certificates expiring within the configured threshold
- Distinguishes newly flagged certificates from those already being tracked
- Notifies the responsible owners and IT team through their preferred communication channel
- Opens a ticket for renewal with the relevant expiry details
- Auto-resolves once the certificate is successfully renewed

## What Certificate Expiration Detection does

Certificate Expiration Detection is Harmony's scheduled monitor for SSL/TLS certificates running out of time. On a recurring schedule it scans every configured domain and service, compares each certificate's expiry date against a configurable threshold, and for anything inside that window it notifies the responsible owner and opens a renewal ticket with the expiry details. It tracks what it has already reported, so each run surfaces new certificates rather than repeating the same list, and it closes its own ticket once the renewal lands.

## Who Certificate Expiration Detection is for

**Persona:** IT operations, platform, and security teams who own the certificates behind public sites, internal services, and API endpoints.

**Pain point:** Certificate expiry is invisible until it isn't. Renewal dates live in someone's calendar, a spreadsheet, or nowhere at all, and the first sign of trouble is usually a browser warning on a customer-facing page or a service that quietly stops trusting its upstream. The renewal itself is trivial; noticing in time is the hard part.

## How Certificate Expiration Detection works

**Trigger:** A recurring schedule, configurable per tenant.

1. **Scan configured endpoints** - Sweeps every domain and service in scope and reads the certificate each one presents, including its expiry date.

2. **Compare against the threshold** - Flags every certificate whose expiry falls inside the configured warning window, so renewals surface with lead time rather than on the day.

3. **Separate new findings from tracked ones** - Checks each flagged certificate against what earlier runs reported, so a renewal already in flight isn't raised again.

4. **Notify the owners** - Alerts the responsible certificate owner and the IT team through each recipient's preferred channel.

5. **Open a renewal ticket** - Creates a ticket carrying the certificate, the service it protects, and the exact expiry date, so whoever picks it up has what they need.

6. **Auto-resolve on renewal** - Confirms the replacement on a later run and closes the ticket without anyone having to remember to.

**Outcome:** Every certificate approaching expiry has a ticket, an owner, and a deadline well before it becomes an outage, and those tickets close themselves once the renewal is in place.

## Capabilities

- **Scheduled certificate sweeps** - Checks every configured domain and service on a recurring schedule rather than on request.
- **Configurable warning window** - The days-before-expiry threshold is set per tenant, so the lead time matches how long your renewal process actually takes.
- **Deduplicated findings** - Distinguishes newly flagged certificates from ones already being tracked, so repeat runs don't repeat themselves.
- **Owner-aware notifications** - Routes each alert to the responsible owner and the IT team through their preferred channel.
- **Renewal tickets with the details attached** - Every ticket carries the certificate, the service behind it, and the expiry date.
- **Automatic closure** - Resolves its own ticket once the certificate has been successfully renewed.

## Main use cases

**Public site certificate about to lapse** - The certificate on a customer-facing domain is three weeks from expiry. The agent flags it inside the warning window, tickets the renewal with the exact date, and notifies the owner, so the fix happens on a normal working day instead of during an incident.

**Internal service trust chain** - An internal API's certificate expires and downstream services stop trusting it, producing failures that look like anything but a certificate problem. Catching the expiry ahead of time means that class of outage never starts.

**Evidence for a certificate hygiene review** - A security review asks how certificate renewals are tracked. The agent's recurring tickets and closure records are the answer, without anyone assembling a spreadsheet after the fact.

## Integrations

| Integration | Role in the agent flow |
| --- | --- |
| SolarWinds | Monitoring signal for the network services in scope |
| Qualys | Certificate and vulnerability scanning data for the hosts in scope |
| Harmony Service Desk | Native ticketing - creates the ticket, tracks it, and records the outcome |
| Harmony Notifications | Delivers updates through each recipient's preferred channel: Slack, Teams, or email |

## FAQ

### Is this a chatbot, or something that runs on its own?

It runs on its own. Certificate Expiration Detection is a scheduled workflow inside Harmony: it wakes on its schedule, scans, and acts. There is no conversation to start.

### How far ahead does it warn?

That's the configurable threshold. Certificates expiring inside the window you set get flagged; anything further out is left alone until it enters the window. Pick the lead time your renewal process actually needs.

### Will it renew the certificate for me?

No. It detects, notifies, tickets, and then confirms and closes once a renewal has happened. Issuing and installing the replacement stays a human step, or a job for whatever certificate automation you already run.

### Will the same certificate be ticketed every run?

No. It tracks what it has already reported and separates new findings from ones already in flight, so an open renewal ticket doesn't collect a duplicate every cycle.

### What has to be in place first?

The domains and services you want covered configured as scope, a desk to receive the tickets, and the notification channels your owners use. Schedule and warning threshold are set per tenant.

## Related agents and features

- [**License Expiration Discovery**](/agents/license-expiration-discovery) - Sibling monitor on the same scan, deduplicate, ticket pattern, for software licenses running out rather than certificates
- **Harmony Service Desk** - Receives the tickets this agent opens and carries the audit trail of what happened