How alerts work
Tidehawk watches every certificate and domain you track and raises an alert when one falls inside a threshold you set.
How often Tidehawk checks
Section titled “How often Tidehawk checks”The alert engine runs every 15 minutes. On each run it reads your enabled alert rules and compares them against every certificate and domain in your workspace.
A new certificate is not discovered by the alert engine itself. Discovery and domain expiry lookups run on their own schedules, and the alert engine works from whatever they have recorded. See Domain expiry tracking.
One alert per item, per threshold
Section titled “One alert per item, per threshold”An alert is raised once. For a certificate, the pair of certificate and threshold is unique for the life of that certificate, so a 30-day rule can never fire twice for the same certificate. The engine runs again 15 minutes later, sees the alert already exists, and does nothing.
That is also why a delivery retry never produces a second email or a second ticket. Tidehawk retries the delivery, not the alert.
A ladder of rules still gives you several alerts as expiry approaches, because each rule has its own threshold. With the recommended ladder you are told at 60 days, again at 30, again at 7 and again at 1 day.
Domains behave slightly differently. Only one open alert can exist for a domain at a given threshold. If the registration is renewed and the registry date moves beyond that threshold, Tidehawk resolves the old alert, and the domain can alert again at the same threshold later on.
Channels
Section titled “Channels”Each rule carries one or both of these channels.
| Channel | What happens |
|---|---|
| An expiry email goes to the addresses on the rule, or to your owners and admins when the rule lists none. See Email alerts. | |
| PSA ticket | A ticket is opened in the connected PSA for that rule. See Ticket lifecycle. |
Both are dispatched in the same transaction that records the alert, so an alert can never be recorded without its delivery being queued.
Certificates that renew themselves
Section titled “Certificates that renew themselves”A certificate on the auto renewal track, such as one issued by an ACME client, renews without anyone doing anything. Alerting on the routine countdown would be noise, so Tidehawk alarms only when renewal looks overdue.
For those certificates the window is one fifth of the certificate’s own validity period, clamped between 3 and 20 days, instead of the rule’s threshold. A certificate valid for 90 days alarms at about 18 days remaining; one valid for 47 days alarms at about 9.
Certificates you have excluded from renewal tracking never alert, and neither do certificates already replaced by a newer one.
What resolves an alert
Section titled “What resolves an alert”Tidehawk closes its own alerts from its own evidence. You do not mark an alert as done.
- A certificate renews. When a newer certificate for the same name is discovered, the old one is marked superseded and every open alert against it is resolved with the reason
cert_superseded. - A domain registration is renewed. The next registry lookup reads the new expiry date. Any open alert whose threshold the new date has outgrown is resolved with the reason
domain_expiry_moved.
In both cases, any PSA ticket Tidehawk opened for that alert is queued for closing at the same moment.
What you will see
Section titled “What you will see”Open Alerts in the app. Rules are listed under the Certificates and Domains tabs, and Recent alerts below shows the 50 most recent events, newest first. Filter them with All, Open, and Failed.
Select a row to open the detail panel, which shows the client, when the alert fired, the email state, the PSA ticket state and whether the alert is still open.