Setup guide
PagerDuty setup guide for sslcertificates.io
This guide explains how to connect PagerDuty to sslcertificates.io, what credentials to prepare, and how to operate safely in Test (Let's Encrypt Staging) and Live (publicly trusted issuance) environments.
What this integration does
PagerDuty sends a test event, stores the provider message id when offered, and records health. PagerDuty is not a partnership.
Category: Notifications & Alerting. Public integration page: /integrations/pagerduty.
Outcomes
- Send certificate expiry alerts to PagerDuty
- Notify your team when issuance or renewal fails
- Keep operational noise in the tools you already watch
Prerequisites
- Active PagerDuty account
- API access
- PagerDuty token or webhook. Least privilege.
Authentication and credentials
Authentication mode in the catalog: api_key.
Fields the connection form expects: Token / webhook URL (required)
Store secrets in a password manager while you paste them once into sslcertificates.io. Values are encrypted at rest and are not shown again after save. Prefer narrowly scoped credentials over admin passwords.
PagerDuty token or webhook. Least privilege.
Permissions (least privilege)
PagerDuty token or webhook. Least privilege.
Incoming webhook URLs are secrets. Legacy Microsoft Office connectors are not implemented; Teams uses Workflows.
Connect in the workspace
- Sign in to sslcertificates.io
- Open Integrations
- Choose PagerDuty
- Enter the connection details
- Test the connection
- Select the resources you want to manage
After Test connection succeeds, run Discover so the platform lists zones, subscriptions, domains, or deploy targets you are allowed to see. Select only resources this organization should manage.
Test vs Live certificate environments
Test uses Let's Encrypt Staging as the CA directory. Staging certificates are not trusted by browsers; use them to prove DNS-01, HTTP-01, deploy scripts, and webhooks without consuming production rate limits.
Live uses Let's Encrypt Production (or a commercial CA you connect) for publicly trusted certificates. The integration connection is the same; only the API key environment and CA selection on the certificate order change.
Create separate API keys labeled Test and Live. Do not reuse a Live key in CI that hammers validation endpoints.
Notifications and exports
Configure PagerDuty to receive webhook-style certificate events from sslcertificates.io. This is operational alerting — not domain validation. Verify signing secrets and retry behavior on your receiver.
Discovery
Discovery runs only after authentication succeeds. The integration enumerates resources the credential may read — hosted zones, subscriptions, domains, clusters, or load balancers depending on PagerDuty. If discovery returns empty, the credential is usually too narrow or pointed at the wrong account or region.
Renewal and ongoing operation
When PagerDuty participates in deployment or DNS automation, renewals re-use the same connection. Watch webhook events such as certificate.renewal_failed and verify the external endpoint after every replacement. A renewed certificate in inventory is not proof HTTPS serves the new leaf.
Disconnect and credential rotation
Open Workspace → Integrations → PagerDuty → Disconnect to remove stored credentials from this organization. DNS integrations should delete only TXT records the platform created for ACME challenges. Rotate vendor tokens on a schedule; update the integration, run Test connection, and revoke the old credential at the vendor.
Troubleshooting
| Symptom | Likely cause | What to do |
|---|---|---|
| Test connection fails immediately | Wrong host, region, or token | Re-copy credentials; confirm clock skew and TLS to the vendor API |
| Discovery is empty | Scoped IAM/token cannot list resources | Widen read permissions temporarily, discover, then tighten |
| Order stuck validating | DNS or HTTP challenge not public yet | Inspect the order challenges; wait for propagation; POST validate |
| Deploy reported success but HTTPS unchanged | Old cert still bound on the edge | Compare served SHA-256 to expected leaf; reload or bind again |
insufficient_scope from sslcertificates.io API |
API key missing abilities | Mint a key with integrations:write and certificates:write |
Stable API error codes are documented at /docs/errors. Include X-Request-Id when contacting support.
Official vendor documentation
Related reading
/docs/integrations— how connectors relate to the REST API/docs/test-vs-live— Test (Staging) vs Live (Production) issuance/docs/troubleshooting— order states and verification/integrations/notifications— other Notifications & Alerting integrations