Certificate Expiry Monitoring with Prometheus & Grafana: Complete Setup

Option 3: cert-manager Metrics (Kubernetes)

If you’re running cert-manager in Kubernetes, it already exposes certificate metrics. No additional exporter needed.

Enable Prometheus Metrics

# cert-manager Helm values
prometheus:
  enabled: true
  servicemonitor:
    enabled: true
    namespace: monitoring
    labels:
      release: prometheus

Or if cert-manager is already installed:

helm upgrade cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --set prometheus.enabled=true \
  --set prometheus.servicemonitor.enabled=true

Key Metrics

Prometheus Scrape Config (if not using ServiceMonitor)

scrape_configs:
  - job_name: 'cert-manager'
    kubernetes_sd_configs:
      - role: pod
        namespaces:
          names: ['cert-manager']
    relabel_configs:
      - source_labels: [__meta_kubernetes_pod_label_app]
        regex: cert-manager
        action: keep
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_port]
        target_label: __address__
        regex: (.+)
        replacement: ${1}:9402

PromQL Queries for Certificate Monitoring

Days Until Expiry (x509-exporter)

# Days remaining for each certificate
x509_cert_expires_in_seconds / 86400

Days Until Expiry (Blackbox)

# Days remaining for probed endpoints
(probe_ssl_earliest_cert_expiry - time()) / 86400

Days Until Expiry (cert-manager)

# Days remaining for Kubernetes certificates
(certmanager_certificate_expiration_timestamp_seconds - time()) / 86400

Certificates Expiring Within 30 Days

# x509-exporter
x509_cert_expires_in_seconds < 2592000

# Blackbox
(probe_ssl_earliest_cert_expiry - time()) < 2592000

# cert-manager
(certmanager_certificate_expiration_timestamp_seconds - time()) < 2592000

Already Expired Certificates

x509_cert_expired == 1

AlertManager Rules

Create alert rules that fire at 30, 14, and 7 days before expiry:

# /etc/prometheus/rules/certificate-alerts.yml
groups:
  - name: certificate_expiry
    rules:
      - alert: CertificateExpiring30Days
        expr: |
          (x509_cert_expires_in_seconds < 2592000 and x509_cert_expires_in_seconds > 0)
          or
          ((probe_ssl_earliest_cert_expiry - time()) < 2592000 and (probe_ssl_earliest_cert_expiry - time()) > 0)
          or
          ((certmanager_certificate_expiration_timestamp_seconds - time()) < 2592000 and (certmanager_certificate_expiration_timestamp_seconds - time()) > 0)
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: "Certificate expiring within 30 days"
          description: "Certificate {{ $labels.filepath }}{{ $labels.instance }}{{ $labels.name }} expires in {{ $value | humanizeDuration }}."

      - alert: CertificateExpiring14Days
        expr: |
          (x509_cert_expires_in_seconds < 1209600 and x509_cert_expires_in_seconds > 0)
          or
          ((probe_ssl_earliest_cert_expiry - time()) < 1209600 and (probe_ssl_earliest_cert_expiry - time()) > 0)
          or
          ((certmanager_certificate_expiration_timestamp_seconds - time()) < 1209600 and (certmanager_certificate_expiration_timestamp_seconds - time()) > 0)
        for: 1h
        labels:
          severity: high
        annotations:
          summary: "Certificate expiring within 14 days"
          description: "Certificate {{ $labels.filepath }}{{ $labels.instance }}{{ $labels.name }} expires in {{ $value | humanizeDuration }}. Immediate renewal required."

      - alert: CertificateExpiring7Days
        expr: |
          (x509_cert_expires_in_seconds < 604800 and x509_cert_expires_in_seconds > 0)
          or
          ((probe_ssl_earliest_cert_expiry - time()) < 604800 and (probe_ssl_earliest_cert_expiry - time()) > 0)
          or
          ((certmanager_certificate_expiration_timestamp_seconds - time()) < 604800 and (certmanager_certificate_expiration_timestamp_seconds - time()) > 0)
        for: 30m
        labels:
          severity: critical
        annotations:
          summary: "Certificate expiring within 7 days — CRITICAL"
          description: "Certificate {{ $labels.filepath }}{{ $labels.instance }}{{ $labels.name }} expires in {{ $value | humanizeDuration }}. Service outage imminent if not renewed."

      - alert: CertificateExpired
        expr: |
          x509_cert_expired == 1
          or
          (probe_ssl_earliest_cert_expiry - time()) <= 0
          or
          (certmanager_certificate_expiration_timestamp_seconds - time()) <= 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Certificate has EXPIRED"
          description: "Certificate {{ $labels.filepath }}{{ $labels.instance }}{{ $labels.name }} has expired. Service is likely experiencing TLS failures."

AlertManager Configuration: Slack & PagerDuty

# /etc/alertmanager/alertmanager.yml
global:
  resolve_timeout: 5m
  slack_api_url: 'https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK'
  pagerduty_url: 'https://events.pagerduty.com/v2/enqueue'

route:
  group_by: ['alertname', 'instance']
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 4h
  receiver: 'slack-warnings'
  routes:
    - match:
        severity: critical
      receiver: 'pagerduty-critical'
      repeat_interval: 1h
    - match:
        severity: high
      receiver: 'slack-high'
      repeat_interval: 2h
    - match:
        severity: warning
      receiver: 'slack-warnings'
      repeat_interval: 12h

receivers:
  - name: 'slack-warnings'
    slack_configs:
      - channel: '#cert-alerts'
        title: '⚠️ Certificate Expiry Warning'
        text: |
          *Alert:* {{ .GroupLabels.alertname }}
          *Instance:* {{ .CommonLabels.instance }}
          *Description:* {{ .CommonAnnotations.description }}
          *Severity:* {{ .CommonLabels.severity }}
        send_resolved: true

  - name: 'slack-high'
    slack_configs:
      - channel: '#cert-alerts'
        title: '🔶 Certificate Expiry — Action Required'
        text: |
          *Alert:* {{ .GroupLabels.alertname }}
          *Instance:* {{ .CommonLabels.instance }}
          *Description:* {{ .CommonAnnotations.description }}
        send_resolved: true

  - name: 'pagerduty-critical'
    pagerduty_configs:
      - service_key: 'YOUR_PAGERDUTY_SERVICE_KEY'
        severity: critical
        description: '{{ .CommonAnnotations.summary }}'
        details:
          instance: '{{ .CommonLabels.instance }}'
          description: '{{ .CommonAnnotations.description }}'

Grafana Dashboard Setup

Import Pre-Built Dashboard

The community dashboard ID 13922 provides a ready-made certificate monitoring view for the x509-certificate-exporter:

1. Open Grafana → Dashboards → Import
2. Enter dashboard ID: 13922
3. Select your Prometheus data source
4. Click Import

Custom Dashboard Panels

For a unified view across all three exporters, create custom panels:

Panel 1: Certificate Expiry Table

# Combine all sources into a single table
sort_desc(
  label_replace(x509_cert_expires_in_seconds / 86400, "source", "file", "", "")
  or
  label_replace((probe_ssl_earliest_cert_expiry - time()) / 86400, "source", "endpoint", "", "")
  or
  label_replace((certmanager_certificate_expiration_timestamp_seconds - time()) / 86400, "source", "k8s", "", "")
)

Panel 2: Certificates Expiring Soon (Stat Panel)

count(x509_cert_expires_in_seconds < 2592000 and x509_cert_expires_in_seconds > 0)
+
count((probe_ssl_earliest_cert_expiry - time()) < 2592000 and (probe_ssl_earliest_cert_expiry - time()) > 0)
+
count((certmanager_certificate_expiration_timestamp_seconds - time()) < 2592000 and (certmanager_certificate_expiration_timestamp_seconds - time()) > 0)

Panel 3: Expiry Timeline (Time Series)

x509_cert_expires_in_seconds / 86400

Set thresholds: Red < 7, Orange < 14, Yellow < 30, Green > 30.

# docker-compose.yml
version: '3.8'

services:
  prometheus:
    image: prom/prometheus:latest
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - ./rules:/etc/prometheus/rules
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'

  alertmanager:
    image: prom/alertmanager:latest
    ports:
      - "9093:9093"
    volumes:
      - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
    volumes:
      - grafana-data:/var/lib/grafana

  blackbox-exporter:
    image: prom/blackbox-exporter:latest
    ports:
      - "9115:9115"
    volumes:
      - ./blackbox.yml:/etc/blackbox_exporter/config.yml

  x509-exporter:
    image: enix/x509-certificate-exporter:latest
    ports:
      - "9793:9793"
    volumes:
      - /etc/ssl/certs:/certs:ro
    command:
      - --watch-dir=/certs
      - --listen-address=:9793

volumes:
  grafana-data:

docker compose up -d