Daily

Get warned 30 days before a certificate expires

Each certificate close to expiry is flagged once, a month ahead, so you have time to renew it.

Runs: Daily
Apps: Cloudflare
AI: Not needed
Access: Zone: Read, SSL and Certificates: Read (confirmed for both endpoints)

Send this to your assistant

Create a ClickRuntime automation: every day at 8am, check the SSL certificates on my Cloudflare zones and post to #ops in Slack any that expire within 30 days, with the zone and expiry date. Only alert once per certificate.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

An expired certificate takes a site offline in the most public way possible. Browsers show a full-screen warning, API clients refuse to connect, and customers assume you have been hacked. It happens most often with certificates that are not renewed automatically, such as custom or uploaded ones that someone installed two years ago and forgot.

Every day, this lists your Cloudflare zones, checks the certificate packs and custom certificates on each, and flags any that expire within 30 days. Certificates that do not report an expiry date are skipped, and each certificate triggers only one alert, so you are not nagged daily.

Teams with custom certificates or many domains use it as insurance against the quiet renewal that never happens. The check is made against expiry dates that Cloudflare reports, so you see the same dates that would apply if nobody renewed anything, and no guessing is needed.

What you get out of it

Avoid an outage from a forgotten certificate
Thirty days is enough time to reissue and install a certificate without panic. The warning arrives while renewal is routine, not after customers see an error page. Thirty days is time enough to reissue and deploy a certificate calmly, without a rushed late-night fix and apologies to customers.
Protect revenue on checkout and login pages
An expired certificate on a shop or login page stops sales and sign-ins immediately. A single early warning is far cheaper than hours of lost orders. A shop or login page with an expired certificate stops taking orders and sign-ins at once, and every hour of that costs real money.
Cover certificates nobody owns
Custom certificates often outlive the person who installed them. A daily check across all zones makes sure ownerless certificates still get noticed. Certificates installed years ago by someone who has since left are exactly the ones that expire unnoticed, and a daily check covers them.
Keep many domains under control
Agencies with dozens of zones cannot track expiry dates by hand. One alert per certificate gives a clear, de-duplicated worklist. An agency with dozens of zones cannot track expiry dates by hand, and a single de-duplicated alert per certificate gives a clean worklist.
Meet security and client requirements
Many contracts and audits require valid certificates at all times. A recorded warning shows that you monitored expiry and acted well before it mattered. Many contracts require valid certificates at all times, and a recorded warning shows you were monitoring expiry well before a deadline.

How it works

What happens, step by step

Every day ClickRuntime checks the SSL certificates on each of your Cloudflare domains.
It looks for any that expire in the next 30 days.
It warns you only once per certificate, so you aren't reminded every day.
Your Slack channel gets the domain and the expiry date.

Before it runs live

Connect Cloudflare

What you get

RunsDaily

Get warned 30 days before a certificate expirestoday, 9:00Succeeded

Slack · #opsSSL certificate for shop.example.com (shop.example.com) expires 2026-11-08

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Cloudflare steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

get_warned_before_an_ssl_certificate_expires.pyexample

from datetime import datetime, timedelta, timezone
from clickruntime import on_trigger, credentials, http, notify, state

CF = "https://api.cloudflare.com/client/v4"

def cf(path, **params):
    resp = http.get(f"{CF}{path}", params=params, headers={"Authorization": f"Bearer {credentials.secret('CLOUDFLARE_API_TOKEN')}"})
    resp.raise_for_status()
    return resp.json()["result"]

@on_trigger
def run(event):
    soon = datetime.now(timezone.utc) + timedelta(days=30)
    alerted = set(state.get("alerted") or [])
    for zone in cf("/zones", per_page=50):
        certs = [c for p in cf(f"/zones/{zone['id']}/ssl/certificate_packs") for c in p.get("certificates", [])]
        certs += cf(f"/zones/{zone['id']}/custom_certificates")
        for c in certs:
            if not c.get("expires_on") or c["id"] in alerted:
                continue
            expires = datetime.fromisoformat(c["expires_on"].replace("Z", "+00:00"))
            if expires < soon:
                notify.slack(f"SSL certificate for {zone['name']} ({', '.join(c.get('hosts', []))}) expires {expires:%Y-%m-%d}", channel="#ops")
                alerted.add(c["id"])
    state.set("alerted", list(alerted))
    return {"alerted": len(alerted)}

FAQ

Common questions

Does it cover Cloudflare's automatically renewed certificates?

It checks certificate packs and custom certificates the API returns with an expiry date. Universal certificates that Cloudflare renews automatically will rarely come close to expiry, so most alerts concern custom ones. Universal certificates are renewed by Cloudflare automatically, so the alerts you receive will mostly be about custom or uploaded certificates.

Why would a certificate be skipped?

The expires_on field is optional in Cloudflare's API. If a certificate does not report it, there is nothing to compare, so it is skipped rather than guessed at. Cloudflare lists expires_on as an optional field, and when a certificate does not report it there is nothing to compare, so it is skipped.

Can I change the 30 day warning period?

Yes. Ask your AI assistant for 14 or 45 days, or for a second earlier warning, and you decide whether it goes ahead. A different lead time, such as 14 or 45 days, or two warnings at different times, can be set and shown to you first.

What permissions does it need?

Zone: Read, SSL and Certificates: Read (confirmed for both endpoints). Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (daily). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

On a schedule