Skip to main content
Cert Spotter is SSLMate’s certificate monitoring service. It continuously watches Certificate Transparency logs, and when it finds a certificate issued for one of your monitored domains that you did not know about (an unknown certificate), it can call a webhook. This integration turns each unknown certificate into one Flashduty alert.

In Flashduty On-call

You can get the integration push URL in either of the following ways.

Use a dedicated integration

  1. In the Flashduty console, select Channel and open a channel
  2. Select Configuration → Integrations → Private integration, then click Add integration
  3. Select Cert Spotter, then click Save
  4. Open the generated integration card and copy the Push URL

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Cert Spotter and enter an integration name
  3. Configure the default route and select a channel. You can add more rules under Routing after creation
  4. Click Save and copy the generated Push URL

Configure Cert Spotter

Webhook notifications are available on the Cert Spotter Startup plan and above. The Hobbyist plan only sends email.
1

Add a webhook in Cert Spotter

Where: SSLMate › Cert Spotter › Settings › notification settingsSave the settings. Flashduty identifies the integration by the integration_key in the URL, so keep the push URL as secret as a key.
2

Turn on the auto-resolve timeout in Flashduty

Where: Flashduty console › Channels (the channel that receives these alerts)An unknown certificate is a one-shot event: after the certificate is revoked, expires, or is confirmed by you, Cert Spotter sends nothing more. In the channel that receives these alerts, turn on the auto-resolve timeout:Closing the incident also closes its alerts.
3

Verify

Cert Spotter has no button that sends a test delivery. Issue a new certificate for a sub-domain you already monitor (for example with Let’s Encrypt). Once the certificate reaches the CT logs, Cert Spotter delivers it as an unknown certificate and a matching alert appears in Flashduty.

Payload

Cert Spotter sends expiration reminders and installation problems only by email and Slack, not by webhook, so they do not reach this integration.

Alert key

Flashduty uses the ID of the certificate issuance (id in the webhook) as the Alert Key. A network problem can deliver the same request more than once; the duplicate carries the same id and merges into the same alert. Different certificates create different alerts. A delivery without id and with an empty dns_name is rejected (HTTP 400). A delivery without id but with a dns_name is a New Endpoint event: it returns 200 and creates no alert.

Status and severity

Cert Spotter sends no severity, so every unknown certificate triggers a Warning alert. Whether the certificate has been revoked is recorded in the revoked label and does not change the severity.

Labels

The alert title is Unknown certificate for <first name>, followed by (+N more) when the certificate covers several names. Names come from the dns_name of endpoints, or from issuance.dns_names when endpoints is empty; when both are empty the title is Unknown certificate <id>.

FAQ

Cert Spotter only notifies you about unknown certificates. Certificates registered through the Cert Spotter authorization API are known certificates and do not trigger the webhook.
The webhook must return 2xx within 15 seconds, and redirects are not followed. Cert Spotter does not retry failed requests automatically; it emails you instead, and you can ask SSLMate to resend them. Make sure the push URL is complete and includes integration_key.
Cert Spotter has no recovery event. Turn on the channel’s auto-resolve timeout, or close the alert manually in Flashduty.
For field details, see Cert Spotter Webhooks.