# Source: paas-metrics
---

- type: replace
  path: /instance_groups/name=prometheus2/jobs/name=prometheus2/properties/prometheus/custom_rules?/-
  value:
    name: PlatformTLSCertificateExpiresSoon
    rules:

      - alert: PlatformTLSCertificateExpiresSoon_Warning
        expr: "paas_tls_certificates_validity_days <= 30"
        for: 5m
        annotations:
          summary: "A platform TLS certificate is close to expiry"
          description: "The TLS certificate for the platform domain {{ $labels.hostname }} expires in {{ $value }} days"
          url: "https://team-manual.cloud.service.gov.uk/incident_management/responding_to_alerts/#invalid-certificates"
        labels:
          severity: warning
          notify: email
          service: elb

      - alert: PlatformTLSCertificateExpiresSoon_Critical
        expr: "paas_tls_certificates_validity_days <= 7"
        for: 5m
        annotations:
          summary: "A platform TLS certificate is very close to expiry"
          description: "The TLS certificate for the platform domain {{ $labels.hostname }} has almost expired!"
          url: "https://team-manual.cloud.service.gov.uk/incident_management/responding_to_alerts/#invalid-certificates"
        labels:
          severity: critical
          notify: email
          service: elb

Add platform TLS certificate expiry alert to Prometheus
Add platform TLS certificate expiry alert to Prometheus

Original DataDog monitor:
min(last_1h):min:tls.certificates.validity{deploy_env:prod} by {hostname} <= 7

For each platform TLS certificate, issue a warning at 30 days validity
and a critical alert at 7 days validity.
