Alerts

Channels

Email ships over SMTP via Postmark. Slack and generic webhooks are configured from Settings and are sent directly from CertWatch's servers to the URL you provide — handling past that point is whatever you've connected it to (see Trust & security).

What triggers an alert

• An endpoint's certificate crossing into a warning or critical expiry threshold.
• A certificate expiring outright.
• An unexpected certificate identity change (issuer or subject) — not caused by your own edit.
• A domain crossing into a warning or critical expiry threshold, or lapsing.

Failed checks (connection errors, DNS failures, timeouts, invalid chains) appear on your dashboard with an error status, but do not trigger alerts — transient network issues are common and worth monitoring without generating noise.

A muted endpoint (see Monitoring behavior) is checked the same as any other, but alert dispatch is suppressed for the mute's duration.

A real alert

The exact wording CertWatch sends in production, with a plausible label/hostname/day-count filled in:

Subject: CertWatch alert: api.example.com

CertWatch: Production API (api.example.com) certificate expires in 12 day(s), on 2026-09-28

We alert on our own monitoring going dark

A dedicated canary check is pointed at a permanently-expired public test certificate, so it's designed to fail on every run. We don't alert on that expected failure — we alert if that check's result ever stops reporting entirely, which is how we'd notice our own monitoring pipeline had gone dark rather than trusting "no alerts" to always mean "everything's fine."