How alerts work
Most certificate monitors send a reminder a fixed number of days before expiry. On short-lived certificates that reminder fires every cycle and gets ignored. NetworkAI alerts when a renewal has actually failed.
Renewal-failure alerts
For each certificate NetworkAI records when it was issued and when it expires. Once less than a third of its lifetime is left, it should have been replaced. If no new certificate (one with a different fingerprint) has appeared for the host by then, you get a renewal failure alert.
| Certificate lifetime | Renewal point (⅓ left) | Alert if not renewed by |
|---|---|---|
| 398 days | about 133 days before expiry | day 265 |
| 200 days | about 67 days before expiry | day 133 |
| 90 days (Let's Encrypt) | 30 days before expiry | day 60 |
| 47 days | about 16 days before expiry | day 31 |
Automated renewals such as certbot or a CDN's managed certificates normally renew at or before this point, so a healthy setup sends nothing at all.
The 7-day and 1-day safety net
Whatever the renewal state, an alert is always sent 7 days and 1 day before a certificate expires, and once if the served certificate has already expired. Only the alert that matches the days left is sent: a domain added with 3 days left gets the 7-day alert, not a burst of every threshold it has passed.
Inside the 7-day window the renewal-failure alert is not sent separately, because the countdown alert already says the certificate has not been renewed.
Extra early warnings (Pro)
Pro accounts can add their own early-warning days in Settings → Alert schedule, such as 30 or 14 days. Each fires once per certificate, and only when the certificate lasts longer than that many days, so a 30-day warning never fires on a 30-day certificate. Keep the list short; the point of renewal-failure alerting is less noise.
When an alert repeats
Each alert is sent once per certificate, per threshold, per channel. The certificate fingerprint is part of that key, so when a renewed certificate appears, alert state resets and the next cycle's alerts can fire again.
- Renewed in time: no alert.
- Renewal failed: one renewal-failure alert, then the 7-day and 1-day alerts if it is still not fixed.
- Fixed after an alert: the new certificate starts a clean cycle.
Where alerts go
Every alert goes to every active channel: email on all plans, and Slack and signed webhooks on Pro. Payloads, signatures and retry rules are on Slack & webhook alerts.
Last updated