Certificate alerts by email

An email channel on a certificate alert emails the recipients you choose whenever the alert fires. Email channels are available on every plan.

If you self-host Infisical, configure an SMTP server before you create an email alert. Without one, Infisical writes alert emails to its logs instead of sending them, so a Send test can look successful even though no email arrives.

Prerequisites

The Certificate Management Admin role to create an organization-wide alert, or the Admin application role to create an application alert
Recipients who are organization members, or addresses on one of your organization’s verified email domains

Create the alert

Infisical UI
API

Open the alert form:

For an organization-wide alert, go to Certificate Manager > Settings, select the Alerts tab, then select Create Alert
For an application alert, go to Certificate Manager > Applications and select your application, then select the Settings tab and select Create Alert in the Alerts section

Select the Alert Type, then enter an Alert Name and an optional Description. An application can have one alert for each event, so to notify more places about the same event, add more channels to that alert.

For an expiration alert, enter Alert Before as a number and a unit. For example: 30d or 2w, up to 365 days.

To get a reminder every day, turn on Repeat daily until expiry. Otherwise, the alert repeats on a schedule based on Alert Before.

Select Continue.

For an organization-wide alert, on the Filters step, optionally select Add Filter to narrow the certificates the alert covers, then select Continue. Application alerts and signer certificate expiration alerts skip this step.

To add this channel to an existing alert instead, edit the alert and go to its Channels step.

On the Channels step, add the email channel:

Select Add Channel > Email.

In Recipients, select organization members, or type an address on one of your organization’s verified email domains and add it.

Optionally, select Send test to send a test email to the recipients.

Select Continue, check the Review step, and select Create Alert.

Send a request to the create alert endpoint with an access token and an email channel.Set resourceType and resourceId to the certificates the alert covers:

Alert	`resourceType`	`resourceId`
Organization-wide	`cert-manager`	Leave out
Application	`cert-manager.application`	The application’s ID, from the list applications endpoint
Signer certificate expiration	`cert-manager.signer`	Leave out

Set eventType to the event the alert watches:

Event	Organization-wide alert	Application alert
Expiration	`cert-manager.certificate.expiry`	`cert-manager.application.certificate.expiry`
Issuance	`cert-manager.certificate.issuance`	`cert-manager.application.certificate.issuance`
Renewal	`cert-manager.certificate.renewal`	`cert-manager.application.certificate.renewal`
Revocation	`cert-manager.certificate.revocation`	`cert-manager.application.certificate.revocation`
Signer certificate expiration	`cert-manager.signer.certificate.expiry`	Not available

Set condition to the same settings as the Alert Before field, the Repeat daily until expiry toggle, and the Filters step in Infisical:

Field	Applies to	Value
`alertBefore`	Expiration alerts (required)	A number and a unit, such as `30d` or `2w`, up to 365 days
`dailyReminder`	Expiration alerts	`true` to repeat the alert every day until the certificate expires
`applicationIds`	Organization-wide alerts	Up to 100 application IDs
`profileIds`	Organization-wide alerts	Up to 100 certificate profile IDs
`sources`	Organization-wide alerts	Any of `issued` (Managed in Infisical), `imported`, and `discovered`
`signerIds`	Signer certificate expiration alerts	Up to 100 signer IDs

For issuance, renewal, and revocation alerts on an application, leave out condition.Each entry in the channel’s recipients array is one of these:

An organization member, with principalType set to user and principalId set to the member’s user.id from the get user memberships endpoint
An address on one of your organization’s verified email domains, with principalType set to email and principalId set to the address

curl --request POST \
  --url https://app.infisical.com/api/v1/alerts \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "issued-certificates-expiring",
    "resourceType": "cert-manager",
    "eventType": "cert-manager.certificate.expiry",
    "condition": { "alertBefore": "30d", "sources": ["issued"] },
    "channels": [
      {
        "name": "platform-team",
        "channelType": "email",
        "recipients": [{ "principalType": "email", "principalId": "[email protected]" }]
      }
    ]
  }'

curl --request POST \
  --url https://app.infisical.com/api/v1/alerts \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "payments-api-expiring",
    "resourceType": "cert-manager.application",
    "resourceId": "<application-id>",
    "eventType": "cert-manager.application.certificate.expiry",
    "condition": { "alertBefore": "30d" },
    "channels": [
      {
        "name": "payments-team",
        "channelType": "email",
        "recipients": [{ "principalType": "email", "principalId": "[email protected]" }]
      }
    ]
  }'

Your alert is set up. Infisical emails the recipients whenever the alert fires.

If a recipient is an organization member, they stop receiving alerts when they leave the organization.

Get started

Certificate authorities

Managing certificates

Monitoring

Code signing

Certificate alerts by email

Prerequisites

Create the alert

​Prerequisites

​Create the alert

Prerequisites

Create the alert