How to configure custom notifications for SSL certificates-Certificate Management Service(SSL Certificate)-阿里云帮助中心

The notification feature of Certificate Management Service allows you to customize SSL certificate reminder policies to meet personalized notification needs.

Notification delivery mechanism

The notification service primarily configures flexible expiration reminder policies for issued SSL Certificates, while providing anomaly alerts at the core stages of the certificate lifecycle, such as certificate download and certificate revocation. In addition, the service supports configuring whether to receive the latest Certificate Management Service product updates and announcements, providing precise and personalized services for your business operations.

Default notification policy

The default notification policy is enabled automatically when a certificate is issued and is free of charge.

	Commercial Certificates	Individual Test Certificate (Pro)	Individual Test Certificate (Free)	Uploaded Certificates
Scenario	Certificate issuance Certificate expiration Certificate revocation	Certificate issuance Certificate expiration Certificate revocation	Certificate issuance Certificate expiration Certificate revocation	Not supported
Notification time	When the certificate is issued: once Remaining validity period of 15 days or less: once a day When the certificate is revoked: once	When the certificate is issued: once Remaining validity period of exactly 20 days: once When the certificate is revoked: once	When the certificate is issued: once Remaining validity period of exactly 20 days: once When the certificate is revoked: once
Notification method	SMS Email Internal message	Email Internal message	Email Internal message
Recipient	Certificate applicant	Certificate applicant	Certificate applicant

Custom notification policy

For the specific policies, see Procedure.

	Commercial Certificates	Individual Test Certificate (Pro)	Individual Test Certificate (Free)	Uploaded Certificates
Billing	Free of charge	Billed by resource ID or subscription instance ID. Fees are deducted when the configuration is modified for the first time.	Billed by resource ID or subscription instance ID. Fees are deducted when the configuration is modified for the first time.	Billed by resource ID or subscription instance ID. Fees are deducted when notifications are enabled for the first time.

Prerequisites

You have Purchase a notification quota.

Procedure

Log in to the Certificate Management Service console.
In the navigation pane on the left, choose Certificate Service > Notification.
The default notification policy is also displayed on this page.
On the SSL Certificates tab, find the certificate for which you want to configure notifications, and click Edit in the Actions column.
To configure notifications for multiple certificates at once, select the certificates and click Batch Edit below the list.

In the Edit Notification panel, turn on notifications, configure the following parameters, and click OK.

Note

The first time you modify the configuration of a certificate, clicking OK consumes one notification quota. Make sure that the configuration is correct before you proceed.
After you modify the notification configuration, the default notification policy no longer takes effect.

Parameter	Description
Alert Contact	Set or add contacts for certificate notifications. Up to 10 contacts are supported.
Notification Method	Select how notifications are delivered. The following options are supported: Email Address Internal Message Text Message DingTalk, WeCom, or Feishu To receive notifications through DingTalk, WeCom, or Feishu, add the corresponding channel when you create a contact on the contact management page. For more information, see Manage contacts.
Notification Content	Select the certificate business reminders, anomaly alerts, and product change notifications that you want to receive. The following options are supported: Business Notification: Download certificate, Pending Expiration, Certificate Hosted, Certificate Revoked, Certificate Deleted, and Share Certificate. Alert Notification: Notification Disabled, Certificate Hosting Failed, and Expired and Not Renewed. Product Change Notification: Update, Change, Upgrade Announcement.
Expiration Deadline Notification	Select the time range for certificate expiration reminders. The following options are supported: 15 Days Before Expiration 30 Days Before Expiration 60 Days Before Expiration 90 Days Before Expiration
Expiration Notification Frequency	Select the frequency of certificate expiration notifications. The following options are supported: Only Once Every Day Every 3 Days Every 5 Days Every 7 Days
Continue Notifications After Revocation	Specify whether to continue sending notifications after the certificate is revoked.

Disable notifications

To stop receiving notifications for a specific certificate, find the certificate in the notification list and turn off the switch in the Is Notification Enabled column. Alternatively, on the details page of the certificate, go to the Notification tab and turn off Notification Status.

FAQ

Why do I receive internal messages but no email or SMS alerts when an SSL Certificate expires?

In the custom notification policy, only Internal message is selected as the Notification method. As a result, no notification is sent over email, SMS or any other channel. Log on to the console and check the notification configuration of the certificate. Make sure that the channels you need, such as email and SMS, are selected as the Notification method, or restore the default notification methods so that notifications reach you over multiple channels.

Why do I still receive renewal or expiration SMS reminders for an SSL Certificate that has the auto-managed service enabled?

The auto-managed service, which covers automatic renewal, automatic validation and automatic deployment, is independent of the notification policy. Even when the auto-managed service is enabled, the system keeps sending SMS messages according to the policy, as long as the notification policy of that certificate still selects the upcoming certificate expiration reminder or the monitoring anomaly notification. Based on your requirements, adjust or clear the relevant expiration reminder options in the notification settings to avoid repeated notifications.

How do I change the email address that receives SSL Certificate notifications without changing the security email address of my Alibaba Cloud account?

You do not need to change the security email address of your Alibaba Cloud account. In the Alibaba Cloud console, go to the Message Center > Basic Receiving Management page, add a RAM user as a message recipient, and select the notification types that relate to SSL Certificates. Certificate notifications are then delivered to a recipient that is independent of the security email address of your Alibaba Cloud account.

Does disabling the expiration alert of an old SSL Certificate affect the expiration notification of a new certificate?

No. The notification policy of each certificate is independent. Disabling the notification of an old certificate does not affect the expiration notification of a new certificate or of any other certificate. As long as the notification of the new certificate itself is in the enabling status, the notification is triggered as expected when that certificate reaches expiration.