Skip to main content
A PagerDuty channel on a certificate alert creates PagerDuty incidents through the Events API v2, so your on-call team gets paged when certificates are about to expire or are revoked.
PagerDuty channels are available under Infisical’s Enterprise plan. If you’re self-hosting Infisical, contact [email protected] to purchase an enterprise license.

​
Prerequisites

  • The Certificate Management Admin role to create an organization-wide alert, or the Admin application role to create an application alert
  • A PagerDuty account that can create services or add integrations to an existing service

​
Step 1: Get a PagerDuty integration key

1
In PagerDuty, go to Services > Service Directory and select New Service.
2
Name the service, for example Infisical PKI Alerts, choose Events API v2 as the integration, and select Create Service.
To use an existing service, open the service and go to Integrations > Add an Integration > Events API v2.
3
Copy the 32-character Integration Key from the service’s Integrations tab.
Anyone with the integration key can send events to your PagerDuty service, so store it like a secret.

​
Step 2: Create the alert

1
Open the alert form:
  • For an organization-wide alert, go to Certificate Manager > Settings, select the Alerts tab, then select Create Alert
  • For an application alert, go to Certificate Manager > Applications and select your application, then select the Settings tab and select Create Alert in the Alerts section
2
Select the Alert Type, then enter an Alert Name and an optional Description. An application can have one alert for each event, so to notify more places about the same event, add more channels to that alert.
3
For an expiration alert, enter Alert Before as a number and a unit. For example: 30d or 2w, up to 365 days.
To get a reminder every day, turn on Repeat daily until expiry. Otherwise, the alert repeats on a schedule based on Alert Before.
Select Continue.
4
For an organization-wide alert, on the Filters step, optionally select Add Filter to narrow the certificates the alert covers, then select Continue. Application alerts and signer certificate expiration alerts skip this step.
To add this channel to an existing alert instead, edit the alert and go to its Channels step.
On the Channels step, add the PagerDuty channel:
1
Select Add Channel > PagerDuty and paste the key from step 1 into Integration key.
2
Optionally, select Send test to send a test event to the PagerDuty service.
3
Select Continue, check the Review step, and select Create Alert.
Your alert is set up. Infisical opens a PagerDuty incident whenever the alert fires.

​
Severity mapping

Each incident’s PagerDuty severity comes from the alert’s event. For expiration alerts, it comes from how close the certificate is to expiry.

​
Expiration alerts

​
Other alert events

​
Incident grouping

Each certificate gets its own incident. If the same alert fires again for the same certificate, PagerDuty updates the existing incident instead of opening a new one. Each PagerDuty channel opens at most 10 incidents per run. If more than 10 certificates are due for an expiration alert, the ones closest to expiry go first and the rest go on the next daily run.