SSL Certificate Expiry Monitor with Slack and Email

id: ssl-certificate-expiry-monitor
namespace: company.team

inputs:
  - id: domains
    type: ARRAY
    itemType: STRING
    displayName: Domains to monitor
    description: List of domains to check SSL certificate expiry for
    defaults:
      - "google.com"
      - "github.com"
      - "kestra.io"
  - id: warning_days
    type: INT
    displayName: Warning threshold (days)
    description: Alert when a certificate expires within this many days
    defaults: 30

tasks:
  - id: check_certificates
    type: io.kestra.plugin.core.flow.ForEach
    values: "{{ inputs.domains }}"
    concurrencyLimit: 5
    tasks:
      - id: fetch_ssl_info
        type: io.kestra.plugin.core.http.Request
        uri: "https://ssl-checker.io/api/v1/check/{{ taskrun.value }}"
        method: GET

      - id: get_expiry_state
        type: io.kestra.plugin.core.kv.Get
        key: "ssl_alerted_{{ taskrun.value | replace('.', '_') }}"
        errorOnMissing: false

      - id: evaluate_cert
        type: io.kestra.plugin.scripts.python.Script
        inputFiles:
          ssl_data.json: "{{ outputs.fetch_ssl_info[taskrun.value].body }}"
        script: |
          import json
          from datetime import datetime, timezone
          from kestra import Kestra

          with open("ssl_data.json") as f:
              data = json.load(f)

          domain = "{{ taskrun.value }}"
          warning_days = {{ inputs.warning_days }}

          # Parse expiry date from SSL checker response
          expiry_str = data.get("cert_exp_date", "")
          is_valid = data.get("cert_valid", False)

          days_left = None
          is_expiring = False

          if expiry_str:
              try:
                  expiry_dt = datetime.strptime(expiry_str, "%Y-%m-%dT%H:%M:%S")
                  now = datetime.utcnow()
                  days_left = (expiry_dt - now).days
                  is_expiring = days_left <= warning_days
              except Exception as e:
                  print(f"Error parsing date: {e}")

          Kestra.outputs({
              "domain": domain,
              "days_left": days_left,
              "expiry_date": expiry_str,
              "is_valid": is_valid,
              "is_expiring": is_expiring or not is_valid,
              "alert_message": (
                  f"INVALID certificate for {domain}"
                  if not is_valid
                  else f"Certificate for {domain} expires in {days_left} days ({expiry_str})"
              )
          })

      - id: send_alert
        type: io.kestra.plugin.core.flow.If
        condition: "{{ outputs.evaluate_cert[taskrun.value].vars.is_expiring and
          outputs.get_expiry_state[taskrun.value].value != 'alerted' }}"
        then:
          - id: slack_alert
            type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
            url: "{{ secret('SLACK_WEBHOOK_URL') }}"
            messageText: |
              :warning: *SSL Certificate Alert*
              Domain: `{{ taskrun.value }}`
              {{ outputs.evaluate_cert[taskrun.value].vars.alert_message }}
              Action required: Renew the certificate immediately.

          - id: email_alert
            type: io.kestra.plugin.email.MailSend
            from: "{{ secret('ALERT_EMAIL_FROM') }}"
            to: "{{ secret('ALERT_EMAIL_TO') }}"
            subject: "[SSL ALERT] Certificate expiring: {{ taskrun.value }}"
            htmlTextContent: |
              <h2 style="color:orange;">SSL Certificate Expiry Warning</h2>
              <p><strong>Domain:</strong> {{ taskrun.value }}</p>
              <p>{{ outputs.evaluate_cert[taskrun.value].vars.alert_message }}</p>
              <p>Please renew the certificate immediately to avoid service disruption.</p>
            host: "{{ secret('SMTP_HOST') }}"
            username: "{{ secret('SMTP_USERNAME') }}"
            password: "{{ secret('SMTP_PASSWORD') }}"
            port: 465

          - id: mark_alerted
            type: io.kestra.plugin.core.kv.Set
            key: "ssl_alerted_{{ taskrun.value | replace('.', '_') }}"
            value: "alerted"
            kvType: STRING

triggers:
  - id: weekly_check
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "0 9 * * 1"
    description: Run every Monday at 09:00 UTC

Catch expiring SSL certificates before browsers do. This blueprint runs a weekly SSL certificate expiry monitor across a configurable list of domains, computes the days remaining until expiration with Python, and fires Slack and email alerts when a certificate crosses your warning threshold. A KV store entry prevents duplicate notifications on every run until the certificate is renewed, so on-call channels stay quiet between real events.

How it works

A io.kestra.plugin.core.trigger.Schedule trigger fires every Monday at 09:00 UTC (cron: "0 9 * * 1").
io.kestra.plugin.core.flow.ForEach iterates over the domains input with concurrencyLimit: 5, checking up to five certificates in parallel.
For each domain, io.kestra.plugin.core.http.Request calls the public ssl-checker.io API to retrieve cert_exp_date and cert_valid.
io.kestra.plugin.core.kv.Get reads the per-domain alert state key (ssl_alerted_<domain>) with errorOnMissing: false.
io.kestra.plugin.scripts.python.Script parses the expiry timestamp, computes days_left, and sets is_expiring when the cert is below the warning threshold or already invalid.
io.kestra.plugin.core.flow.If gates alerting on is_expiring AND the KV state not equal to alerted.
When triggered, io.kestra.plugin.slack.notifications.SlackIncomingWebhook posts a warning to Slack and io.kestra.plugin.email.MailSend sends an HTML email via SMTP on port 465.
io.kestra.plugin.core.kv.Set writes alerted to the KV key so the same certificate does not re-alert on the next weekly run.

What you get

Parallel SSL checks across many domains with a single declarative flow.
Configurable warning_days threshold (default 30) plus detection of already-invalid certificates.
Deduplicated alerts via Kestra KV state, one notification per certificate per renewal cycle.
Slack message and HTML email with the domain, days remaining, and expiry date.
Weekly cron coverage with no servers to maintain.

Who it's for

DevOps, SRE, and platform teams owning certificate lifecycle across many domains.
Security teams that need auditable, proactive expiry coverage.
SaaS companies avoiding outages and browser warnings from forgotten renewals.
Agencies managing SSL for multiple client websites.
Teams replacing paid monitors (SSL Shopper, Pingdom certificate checks) with a self-hosted pipeline.

Why orchestrate this with Kestra

ssl-checker.io is a stateless API, it cannot remember which domains you already alerted on, batch them, throttle to a daily window, or notify multiple channels at once. Kestra adds the missing layer: a scheduled trigger, a ForEach with bounded concurrency, retries on transient HTTP failures, KV state to suppress duplicate alerts, declarative YAML versioned in Git, and full execution lineage per domain. Replace the schedule with a webhook or event trigger and the same flow becomes on-demand. Swap Slack for Teams, PagerDuty, or Opsgenie without rewriting the check logic.

Prerequisites

A Kestra instance with the plugin-scripts-python, plugin-notifications (Slack), and plugin-email plugins available.
A Slack Incoming Webhook URL.
SMTP credentials for outbound email (host, username, password, sender, recipient).

Secrets

Configure these secrets in your Kestra instance or namespace:

SLACK_WEBHOOK_URL, the Slack Incoming Webhook for alert messages.
ALERT_EMAIL_FROM, the sender address used by MailSend.
ALERT_EMAIL_TO, the recipient address for SSL alerts.
SMTP_HOST, the outbound SMTP server (SMTPS on port 465).
SMTP_USERNAME, the SMTP user.
SMTP_PASSWORD, the SMTP password.

Quick start

Add the blueprint to a namespace and set the required secrets above.
Edit the domains input default list, or pass domains at execution time.
Adjust warning_days if 30 days is too aggressive or too lax for your renewal SLA.
Trigger one manual execution to verify Slack and email both deliver.
Leave the schedule enabled, the Monday 09:00 UTC run will handle the rest.

How to extend

Log every check (not just alerts) to a Postgres or BigQuery table for historical reporting.
Add an escalation branch: critical (days_left <= 7) goes to PagerDuty, normal stays in Slack.
Reset the KV alerted key automatically once days_left jumps back above the threshold (renewal detected).
Add an internal-CA branch that hits a private SSL inspection endpoint instead of ssl-checker.io.
Group alerts by team using domain-to-owner mapping pulled from a CMDB or YAML input.
Swap the weekly schedule for an event trigger that runs after every deploy.

Monitor SSL Certificate Expiry and Alert via Slack and Email Before They Expire

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Monitor SSL Certificate Expiry and Alert via Slack and Email Before They Expire

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

Rolling Ansible Patch Wave with Health Gates

Run an Ansible Playbook from a Git Repository

Render Kestra-Templated Ansible Playbooks Before Execution

Ansible with a Dynamic NetBox Inventory and ServiceNow Record

IIS Site Provisioning with SSL Binding and Health Check

Ansible 101, How to Orchestrate and Run a Simple Ansible Playbook

New to Kestra?