Send SSL certificate expiry alerts to Slack

If your team lives in a Slack channel, that's where an expiring certificate belongs. This guide connects Slack to your OctoPing workspace, points a notification at a channel and sets how many days ahead the warning starts.

What you need

• A Slack workspace where you're allowed to approve an app install, or someone who is.
• A role of Admin or Owner in OctoPing to connect Slack. Members can then add Slack notifications to sites.
• A monitored site with an address that starts with https://. A site on http:// has no certificate to read, so it's skipped.

Set up the Slack alert

1. 1. Connect Slack to the workspace

   Slack is connected once for the whole OctoPing workspace. Open Settings, find the Slack Integration card and choose Add to Slack. Slack asks you to approve the app. OctoPing requests three permissions: posting messages as a bot, listing public channels and listing the private channels the bot has joined. When you come back, the card shows Connected with your Slack workspace's name.

2. 2. Invite the app to the channel

   In Slack, open the channel that should get the alerts and enter /invite @OctoPing. The app can only post to a channel it has joined.

3. 3. Choose how early to warn

   Open the site, choose Edit and find the SSL Certificate Expiration row. Alert days before expiry starts at 30. Once the certificate has that many days left or fewer, each check can send a warning. Pick a window that leaves your client time to approve a purchase or fix the renewal job, then choose Save Changes. The row's Check every setting starts at every day and offers 1 hour, 6 hours, 12 hours, 1 day, 1 week.

4. 4. Add the Slack notification

   On the site's Notifications page, choose Add Notification, set Notification Type to Slack and pick the channel in the Slack Channel list. Under Alert on, make sure Site goes down is on. That switch also carries certificate warnings.

5. 5. Send a test

   Choose Send Test on the notification. A test message appears in the channel and the result appears on the page. It proves the app can post there, and the certificate warning uses the same route.

What the message looks like

The Slack message has a header, five fields, a short line of text and a button that opens the site in OctoPing. The example below is the layout OctoPing built in our test run, with the site replaced. The header's icon changes to a siren at 7 days left or fewer.

SSL Certificate Expiring

Website:            https://client.example/
Alert Type:         SSL Expiry
Last Checked:       <time of the last check>
Days Until Expiry:  45
Issuer:             Let's Encrypt

The SSL certificate for this website is expiring soon.
Please renew it to avoid service disruptions.

[ View in OctoPing ]
Sent by OctoPing

A site gets at most one certificate warning every 24 hours, and that one send reaches each notification that has Site goes down on. If the same site also has an email notification, both go out together, and the next one is a day away. A maintenance window doesn't silence the warning.

Verify it works

• Send Test posts to the channel you picked.
• The site's SSL Certificate card shows the issuer, Valid Until and the days left.
• To see a real warning once, raise Alert days before expiry above the days left, save, and wait for the next check. In our test, a window of 90 days on a certificate with 45 days left sent the email and built the Slack message shown above in the same run. A second check straight after sent nothing, and a window of 1 day sent nothing at all. The Slack install and the first real post are the part you run yourself. Set the window back afterwards.

What this alert does not cover

• A certificate that has already failed verification, for example because it expired or was issued for another name, doesn't send this warning. The uptime check fails with a TLS error instead, and the down alert says so.
• A check that can't connect records the error and tries again at the next scheduled check without sending anything.
• OctoPing sends each Slack message once and doesn't retry it. If the channel is deleted or the app is removed from it, the notification log shows the error Slack returned and the next alert is the next attempt. Add an email notification to the same site if you can't afford a missed warning.