3. Notifications

3.1. Notification types

TrustView offers many types of notifications, which can be used for different kinds of purposes and scenarios.

The following notification types are available:

  • Monthly status notifications (Sent on the 1st of each calendar month, by default)

  • Normal expiry notifications (Sent once 30 days before certificate expiry, by default)

  • Critical expiry notifications (Sent once 14 days before certificate expiry, by default)

  • Monitored object-specific notifications (Sent once 30 and 14 days before certificate specific expiry for Normal and Critical notifications)

  • (CT logs) Certificate issuances logged (Checked periodically (roughly every 17 hours) and sent for each newly logged certificate found on your monitored domains, unless disabled - see Certificate Transparency (CT) domain monitoring for how domains are registered)

  • Certificate checkout notifications (Sent to a designated email each time an SSL certificate is checked out, if enabled)

  • Login notifications (Sent to a designated email each time any user logs in, if configured - see Login notifications below)

  • New user notifications (Sent to a new user when their account is created, unless disabled - see New user notifications below)

  • Outdated issuer notifications (Weekly digest listing Automation Tasks and agents whose ADCS template or other issuer is no longer orderable, sent unless disabled - see Outdated issuer notifications below)

3.2. Configure normal and critical notification settings

To configure what days during a week and how long before expiry the notifications are sent, you can go to:

My settings Notification settings

Here you can enable or disable receiving Normal or Critical notifications on the following days:

  • Monday

  • Tuesday

  • Wednesday

  • Thursday

  • Friday

  • Saturday

  • Sunday

Note

If all days are disabled, you will no longer receive any notification for that type (Normal or Critical).

There is also a single on/off checkbox for each of Normal and Critical notifications, separate from the seven day checkboxes above. For a newly created user, Normal notifications are enabled by default and Critical notifications are disabled by default - the two are not symmetric out of the box.

The default number of days before expiry for Normal (30) and Critical (14) can also be changed per user, right here in the same section.

If you change the settings under My settings, they only apply to the user actively logged into TrustView.

3.3. Disable monthly status and CT logs notifications

By default, the monthly status notification mails are enabled and sent out on the 1st of each calendar month, but they can be disabled by going to My settings Additional notification settings.

Note

The monthly status mail only ever reaches users with the Superuser role - enabling this checkbox as a Global administrator, User or Read-only user has no effect. It also requires a TrustView API key to be registered and at least one active monitored object in the user group, or nothing is sent regardless.

Under the same section, you can also disable notifications for CT Logs, if they are not relevant for you, since they are enabled by default.

Note

This only disables the notification e-mails. See Certificate Transparency (CT) domain monitoring for how domains get registered for CT log monitoring in the first place, and how to disable the monitoring itself.

The same Additional notification settings section also has a checkbox for SSL order approval request notifications, for users with approval permissions.

3.4. Types of monitored objects

Under My settings Types of monitored objects, you can choose which kinds of monitored objects - SSL endpoints, SSL certificates, OCES certificates, manual expiry alarms, ADFS certificates, revocation lists and agent connections - are included in your own expiry notification e-mails. All types are included by default; unchecking one leaves it out of your Normal, Critical and monitored-object-specific notifications.

Note

A manual expiry alarm is a manually-tracked expiring object or certificate, rather than one discovered by scanning - see Manual expiry alarms under List View of Monitored Objects for how to create one.

3.5. How to use a shared mailbox for notification emails

Create a new local user and under My settings User details, enter the email that you wish to use for receiving the notification emails. See this for help on how to create a new local user.

You can then disable all notifications under My settings Notification settings for all other users, to prevent them from receiving any notification emails, which will then only be received on the shared mailbox.

Tip

This can also be used in collaboration with an ITSM (IT Service Management) type of software, to automatically open tickets or incidents etc.

3.6. How to change the sender of the notification emails

To change the sender of notification emails from TrustView, follow this guide here.

3.7. External contacts

Under the detail page of each object (SSL endpoints, SSL certificates etc.), under notifications, external contacts can be added to receive notifications. Multiple objects can also have external contacts added at once - see Bulk operation buttons on the monitored object list view.

You can add new external contacts in TrustView, by going to Users, organizations and contacts External contacts. Once a new contact has been added, they will be available to select for notifications, under each monitored object.

Days before expiry to notify an external contact are set on that contact’s own edit page (Users, organizations and contacts External contacts edit a contact) - not under Settings. Normal notifications default to 30 days and are enabled by default; Escalated notifications default to 14 days and are disabled by default - each can be toggled and adjusted independently per contact.

The same contact edit page also lists every monitored object currently associated with that contact, under Monitored objects. From there, Send list of monitored objects immediately e-mails that same list to the contact, without waiting for the next scheduled notification. Deleting a contact that has monitored objects associated with it will warn that this also removes the contact from being notified about them.

3.8. Checkout notifications

It is possible to send out a notification to a designated email, each time an SSL certificate is checked out from TrustView. This can be done by going to: Settings Certificate keystore checkout notification mail

Tip

The email used can be either a shared mailbox or for an individual, depending on your needs.

3.9. Login notifications

TrustView can also send a short e-mail to a chosen address every time any user logs in, for environments that want an audit trail of sign-ins. This is configured in TrustView.groovy rather than through the UI - see Get an e-mail notification on every login under Maintenance for how to set it up.

3.10. New user notifications

By default, a new user - local, AD-integrated or signed in via Azure SSO - receives a notification about their new account. This can be turned off for every new user in TrustView.groovy - see this tip under Users, Groups and Roles for how.

3.11. Outdated issuer notifications

A daily job checks every recurring Automation Task, agent activation template and active agent connection against the issuers currently available for ordering, and flags any that reference an ADCS template, ACME issuer or other issuer that is no longer orderable (for example because its Order filter was turned off, or the ADCS connection backing it was disabled - see What happens when a CA connection or template is disabled under ADCS). Once a week, a digest e-mail listing the currently flagged objects is sent to every user with automation write permission.

Tip

Each user can opt out individually, under My settings Additional notification settings. The flag itself clears automatically once the object is pointed at a different, orderable issuer, or if the original one becomes orderable again - there is nothing to acknowledge or dismiss manually.

3.12. Add additional notification for each separate automation agent

If you want to implement additional notifications, besides the ones in TrustView, it’s possible to configure notifications for some ACME clients, which you can confirm by checking their respective documentation.

3.12.1. Example

Check the documentation for simple-acme here - it supports e-mail (SMTP) and script-based notifications, configured in the Notification section of settings.json.

3.13. Customizing notifications

The content of both email and SMS notifications can be customized to your needs, using plain HTML. This can be done separately for both languages (Danish and English). See Message Templates for a walkthrough of the settings page itself.

To start customizing the notifications, go to Message templates. Then choose the notification type to customize:

  • Daily expiry notifications

  • Certificate check-out

  • Summary mail sent to contacts

3.13.1. Daily expiry notifications

Here you can customize the daily notification mails sent to TrustView users and external contacts. This can be done with HTML, inline styling and tags. The following tags are available for use:

  • #ReceiverName inserts the name of the user or contact the mail is sent to

  • #ExpirationTable inserts what makes up the most important part of the notification mail. It lists all the expiring monitored objects, with the data columns you picked. It’s made of basic HTML, so you can style it as you please

  • #ExpirationCount inserts the number of expiring monitored objects covered in the notification mail

  • #UserGroupName inserts the name of the user group

  • #recentlyExpirationsTable inserts table of recently expired objects

  • #UpcomingExpirationsTable inserts table of upcoming expiring objects

  • #olderExpirationsTable inserts table of older expiring objects than listed by the other tables

  • #notificationType inserts the type of the notification mail. Displayed as either NORMAL or CRITICAL

3.13.2. Certificate check-out

These message templates are used when exporting SSL certificates from TrustView. They can be customized with HTML, inline styling and tags. The following tags are available for use:

  • #CheckoutID inserts a unique ID, so you can keep track of which messages pair with each other

  • #Subject inserts information about who the certificate is issued to (Certificate Subject field)

  • #Password inserts the password for the file. This tag can only be used in the body of the password message

  • #ExtraInfo inserts extra information provided from you during check-out

  • #UrlToWebPage inserts the link to the self-service checkout web page, for checkouts using that delivery method

  • #DeliveryMethod inserts the delivery method chosen for the checkout

  • #WebpageAccessCode inserts the access code needed to open the self-service checkout web page

3.13.3. Summary mail sent to contacts

This is not the monthly status mail - it’s the daily summary mail sent to each external contact (see “External contacts” above), listing the monitored objects expiring within that contact’s own configured thresholds. The content, like the other notification mails, can be customized here with HTML, inline styling and adding or removing column fields. The following tags are available for use:

  • #name inserts the name of the external contact the mail is sent to

  • #list inserts the table of expiring monitored objects for that contact

Important

If you regret the changes, you can reset each message template to its default by clicking Reset to default templates.

3.14. Troubleshooting

3.14.1. Not receiving any email notifications

If you encounter any issues related to not receiving any notification email(s), there may be an issue with your SMTP server setup. In general, the issue would be on your side, since Cryptomathic is not responsible for your SMTP server and gateway setup, only the SMS-related notifications often used in relation to check-out.

Tip

Check this section of the documentation here on how to change the SMTP gateway, if necessary. For additional details on the specific error, you can also check the TrustView logfile here.

You can try this PowerShell command to verify the connection, from the TrustView server:

Verify the SMTP connection
1Test-NetConnection <smtp.server.dk> -Port 25

Note

Change the port to match your setup. If in doubt, check the SMTP section of the TrustView.groovy configuration file. Often port 25 or 587 is used.

Check if the SMTP server resolves from the TrustView server
1nslookup smtp.server.dk

If you have OpenSSL available on the server, you can verify if the TLS is configured, depending on the port used:

Verify TLS
1openssl s_client -starttls smtp -connect smtp.server.com:587

3.14.2. Not receiving any SMS notifications

If you do not receive any SMS notifications during check-out of an SSL certificate or from TrustView in general, Cryptomathic may have downtime on their SMS supplier. You can check the status of the system under Systemstatus SMS gateway. That should show Available and if not, you can contact our Support for assistance.

3.14.3. Receiving empty email notifications

If you are receiving empty email notifications regarding certificate expiry, then contact our Support for assistance, since that should not happen and may be a technical issue.

3.14.4. Receiving CT logs Unexpectedly

If you suddenly start receiving CT logs, it will be because you added one or more domains to the Domain Scan discovery method. If they are unnecessary for you, they can be disabled under My settings Additional notification settings.