groups:
  - name: cert_expiry
    interval: 60s
    rules:
      - alert: CertExpiringWarning
        expr: cert_expiry_days < 30
        for: 1h
        labels:
          severity: medium
        annotations:
          summary: "TLS certificate on {{ $labels.host }}:{{ $labels.port }} expires in {{ $value | printf \"%.0f\" }} days"
          description: "The TLS certificate on {{ $labels.host }}:{{ $labels.port }} will expire in {{ $value | printf \"%.0f\" }} days. An expired certificate will cause TLS handshake failures for all clients. Renew the certificate before expiry to avoid a service disruption."

      - alert: CertExpiringSoon
        expr: cert_expiry_days < 7
        for: 30m
        labels:
          severity: high
        annotations:
          summary: "TLS certificate on {{ $labels.host }}:{{ $labels.port }} expires in {{ $value | printf \"%.0f\" }} days"
          description: "The TLS certificate on {{ $labels.host }}:{{ $labels.port }} will expire in {{ $value | printf \"%.0f\" }} days. Immediate renewal is required. Once expired, all TLS connections will be rejected, causing a complete service outage for any client that enforces certificate validation."

      - alert: CertExpired
        expr: cert_valid == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "TLS certificate on {{ $labels.host }}:{{ $labels.port }} has expired"
          description: "The TLS certificate on {{ $labels.host }}:{{ $labels.port }} has expired. All clients enforcing certificate validation will be unable to establish TLS connections, resulting in a complete service outage. Renew and deploy a new certificate immediately."
