Adjusting Certificate Monitoring Alert Settings
Notification settings in monitoring profiles control which types of certificate issues generate alerts. This allows you to focus on the errors that matter most to your environment and reduce alert fatigue from expected conditions.
Notification Options
Navigate to Certificate & TLS Monitoring ➡️ Manage ➡️ Profiles and edit a profile to access the Notification Settings section. Each setting can be independently enabled or disabled:
Alert when we reach your defined expiration thresholds triggers notifications based on the day values configured in the profile. This is typically the most important alert type and should remain enabled unless you have alternative expiration monitoring. See adjusting alert thresholds for threshold configuration.
Alert on name verification failures notifies you when the certificate's Common Name or Subject Alternative Names don't match the hostname being monitored. Disable this for services where hostname mismatches are expected, such as development environments or when monitoring by IP address.
Alert on CA verification failures triggers when the certificate chain cannot be validated or uses an untrusted Certificate Authority. Disable this when monitoring services with known self-signed certificates or when using private CAs that aren't configured in the profile's Private CA settings.
Alert on integrity / configuration failures covers various certificate and server configuration issues including incomplete certificate chains, missing intermediate certificates, or improper certificate installation. Keep enabled for production services.
Alert on connection failures notifies you when the system cannot establish a connection to the monitored service. This might indicate network issues, firewall rules, or service downtime. Disable for intermittently available services or maintenance windows.
Alert on missing / misconfigured DNS CAA records triggers when DNS CAA records are absent or improperly configured: no CAA record exists for the domain, the records do not authorize the certificate's issuing CA, forbid all issuers, are malformed, carry an unrecognized critical tag, or the CAA lookup itself fails. CAA records specify which Certificate Authorities can issue certificates for your domain. Disable for internal services or when CAA records aren't applicable to your infrastructure.
Alert on server misconfigurations notifies you when the addresses behind the hostname serve different certificates (Certs Did Not Match), usually because one server, load balancer or CDN node missed a renewal.
Alert on certificate changes notifies you when the SHA-256 fingerprint of the leaf certificate differs from the previously recorded fingerprint. This detects unexpected certificate replacements outside of normal renewal cycles.
Alert when certificate flapping is detected triggers once when the certificate changes back and forth three or more times across the last five checks. This typically indicates that different CDN or load-balancer nodes are serving different certificates: a misconfiguration that causes repeated spurious change alerts and can mask expiry issues. A second notification is sent automatically once the last three checks have all read the same certificate. An expiration threshold crossed during a flapping episode is alerted once the episode is over. Disable this if you intentionally run nodes with different certificates.
Dismissed Findings
A finding you've dismissed on a monitor doesn't alert for that monitor, whatever the profile's settings. Restore it on the monitor's report to be alerted again.
Customizing for Different Environments
Production profiles typically enable all alert types to catch any potential issues. Staging or development profiles might disable name verification and CA verification alerts if using self-signed certificates or non-standard hostnames. Internal service profiles might disable DNS CAA alerts for services not exposed to the public internet.
Profile changes immediately apply to all monitors using that profile. Consider creating separate profiles for different service tiers or environments rather than frequently modifying notification settings on production profiles. See best practices for profile strategy recommendations.