Certificate alerts in Slack

A Slack channel on a certificate alert posts to a Slack channel through an Incoming Webhook whenever the alert fires.

Slack channels are available under Infisical’s Enterprise plan. If you’re self-hosting Infisical, contact [email protected] to purchase an enterprise license.

Prerequisites

The Certificate Management Admin role to create an organization-wide alert, or the Admin application role to create an application alert
A Slack workspace where you can create apps

Step 1: Create a Slack incoming webhook

Go to the Slack API Apps page, select Create New App, then select From scratch.

Name the app, for example Infisical PKI Alerts, pick your workspace, and select Create App.

In the app settings, go to Incoming Webhooks and turn on Activate Incoming Webhooks.

Select Add New Webhook to Workspace, pick the Slack channel for alerts, and select Allow.

Copy the Webhook URL.

Anyone with the webhook URL can post to your Slack channel, so store it like a secret.

Step 2: Create the alert

Infisical UI
API

Open the alert form:

For an organization-wide alert, go to Certificate Manager > Settings, select the Alerts tab, then select Create Alert
For an application alert, go to Certificate Manager > Applications and select your application, then select the Settings tab and select Create Alert in the Alerts section

Select the Alert Type, then enter an Alert Name and an optional Description. An application can have one alert for each event, so to notify more places about the same event, add more channels to that alert.

For an expiration alert, enter Alert Before as a number and a unit. For example: 30d or 2w, up to 365 days.

To get a reminder every day, turn on Repeat daily until expiry. Otherwise, the alert repeats on a schedule based on Alert Before.

Select Continue.

For an organization-wide alert, on the Filters step, optionally select Add Filter to narrow the certificates the alert covers, then select Continue. Application alerts and signer certificate expiration alerts skip this step.

To add this channel to an existing alert instead, edit the alert and go to its Channels step.

On the Channels step, add the Slack channel:

Select Add Channel > Slack and paste the URL from step 1 into Webhook URL. The URL must start with https://hooks.slack.com.

Optionally, select Send test to send a test message to the Slack channel.

Select Continue, check the Review step, and select Create Alert.

Send a request to the create alert endpoint with an access token and a slack channel, and set webhookUrl in the channel’s config to the URL from step 1.Set resourceType and resourceId to the certificates the alert covers:

Alert	`resourceType`	`resourceId`
Organization-wide	`cert-manager`	Leave out
Application	`cert-manager.application`	The application’s ID, from the list applications endpoint
Signer certificate expiration	`cert-manager.signer`	Leave out

Set eventType to the event the alert watches:

Event	Organization-wide alert	Application alert
Expiration	`cert-manager.certificate.expiry`	`cert-manager.application.certificate.expiry`
Issuance	`cert-manager.certificate.issuance`	`cert-manager.application.certificate.issuance`
Renewal	`cert-manager.certificate.renewal`	`cert-manager.application.certificate.renewal`
Revocation	`cert-manager.certificate.revocation`	`cert-manager.application.certificate.revocation`
Signer certificate expiration	`cert-manager.signer.certificate.expiry`	Not available

Set condition to the same settings as the Alert Before field, the Repeat daily until expiry toggle, and the Filters step in Infisical:

Field	Applies to	Value
`alertBefore`	Expiration alerts (required)	A number and a unit, such as `30d` or `2w`, up to 365 days
`dailyReminder`	Expiration alerts	`true` to repeat the alert every day until the certificate expires
`applicationIds`	Organization-wide alerts	Up to 100 application IDs
`profileIds`	Organization-wide alerts	Up to 100 certificate profile IDs
`sources`	Organization-wide alerts	Any of `issued` (Managed in Infisical), `imported`, and `discovered`
`signerIds`	Signer certificate expiration alerts	Up to 100 signer IDs

For issuance, renewal, and revocation alerts on an application, leave out condition.

curl --request POST \
  --url https://app.infisical.com/api/v1/alerts \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "certificate-revocations",
    "resourceType": "cert-manager",
    "eventType": "cert-manager.certificate.revocation",
    "channels": [
      {
        "name": "pki-alerts",
        "channelType": "slack",
        "config": { "webhookUrl": "<slack-webhook-url>" }
      }
    ]
  }'

curl --request POST \
  --url https://app.infisical.com/api/v1/alerts \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "payments-api-expiring",
    "resourceType": "cert-manager.application",
    "resourceId": "<application-id>",
    "eventType": "cert-manager.application.certificate.expiry",
    "condition": { "alertBefore": "30d" },
    "channels": [
      {
        "name": "payments-alerts",
        "channelType": "slack",
        "config": { "webhookUrl": "<slack-webhook-url>" }
      }
    ]
  }'

Your alert is set up. Infisical posts to the Slack channel whenever the alert fires.

Message format

Each Slack message includes the alert’s summary, up to two certificates, and a View in Infisical button. For an application alert, the button opens the application. For an organization-wide alert, it opens the Inventory page, or the Signers page for a signer certificate expiration alert. The message color shows the alert’s severity:

Color	Severity	When
Red	Critical or error	A certificate expires within 14 days
Amber	Warning	A certificate expires within 15 to 30 days, or a certificate was revoked
Blue	Info	A certificate expires in more than 30 days, or a certificate was issued or renewed

Get started

Certificate authorities

Managing certificates

Monitoring

Code signing

Certificate alerts in Slack

Prerequisites

Step 1: Create a Slack incoming webhook

Step 2: Create the alert

Message format

​Prerequisites

​Step 1: Create a Slack incoming webhook

​Step 2: Create the alert

​Message format

Prerequisites

Step 1: Create a Slack incoming webhook

Step 2: Create the alert

Message format