MERLONIX
Sign inStart free

How to Configure Slack Alerts for Client SSL Expiry

Slack is where most agency teams already live. Routing SSL expiry alerts to a dedicated Slack channel means you catch certificate problems before your clients do — without needing to check a separate dashboard.

This guide walks through the two-channel setup that most agencies use: a #monitoring-internal channel that receives all alerts (warning and critical), and a second channel or client contact that only receives critical alerts. The setup takes about ten minutes.

What you need

  • A Merlonix account with at least one asset configured
  • A Slack workspace where you can create an app and Incoming Webhook
  • Admin permission in your Slack workspace (or a Slack admin who can create the webhook for you)

Part 1: Create a Slack Incoming Webhook

A Slack Incoming Webhook is a URL that accepts POST requests and posts messages to a specific Slack channel. You create one per channel you want to receive alerts.

Step 1: Go to the Slack API dashboard

Visit api.slack.com/apps and click Create New App.

Choose From scratch, give it a name (e.g., Merlonix Alerts), and select your workspace.

Step 2: Enable Incoming Webhooks

In the left sidebar, click Incoming Webhooks. Toggle Activate Incoming Webhooks to On.

Step 3: Add a webhook to a channel

Scroll down and click Add New Webhook to Workspace. Select the channel you want alerts to go to (e.g., #monitoring-internal).

Authorize the app. Slack generates a webhook URL that looks like:

https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

Copy this URL. You will use it in the next step.

For a second channel: repeat steps 2–3, selecting a different channel (e.g., #client-alerts). Each channel needs its own webhook URL.

Part 2: Add the Slack channel to Merlonix

Step 1: Open Alert Channels

In Merlonix, go to Settings → Alert channels and click Add channel.

Step 2: Select Slack

Choose Slack as the channel type. Paste the Incoming Webhook URL from the previous step.

Step 3: Set the severity filter

Choose which alert levels this channel should receive:

Channel purposeSeverity setting
Internal team channel (#monitoring-internal)Warning and above
Client-facing channel or client contactCritical only

Warning captures SSL certificates 8–30 days from expiry — enough time to act before clients notice anything. Critical fires at 7 days or less, and also for key downgrades and issuer anomalies that require immediate attention.

Setting your internal channel to warning means you see the problem 8–30 days early. Setting it to critical only means you might get a 7-day warning and have to scramble for a renewal over a weekend.

Step 4: Save and test

Click Save. Then click Test — Merlonix sends a sample alert payload to your webhook URL.

In Slack, you should see a test message appear in the channel within a few seconds. If it does not arrive:

  • Confirm the webhook URL is correct (no extra spaces, correct channel)
  • Check that the Slack app is still authorized (visit your app's webhook settings and confirm the webhook is active)
  • Check your Slack workspace's app restrictions if your workspace has admin-only app installation

Part 3: Add a second channel for critical-only alerts

If you want clients to receive Slack alerts directly, or if you want a separate #client-critical channel, repeat Part 1 and Part 2 with:

  • A new webhook pointing to the target channel
  • Severity filter set to Critical only

This produces two alert streams:

  • #monitoring-internal receives everything at warning and above — your team sees problems early
  • #client-critical or client Slack channel receives only critical alerts — the ones that need action right now

What alert messages look like

When Merlonix fires a Slack alert, the message includes:

🔴 [CRITICAL] SSL expiry — Client A — main site
clienta.com expires in 6 days
→ https://app.merlonix.com/app/assets/<id>

The emoji and severity level change with the alert level:

  • 🔴 CRITICAL — requires immediate action
  • 🟡 WARNING — action needed within days
  • 🔵 INFO — state change, no immediate action required

The direct link opens the asset detail page in Merlonix, where you can see the full check history and trigger a manual recheck.

Common configurations

Agency managing 20+ clients

  • One #monitoring-internal Slack channel, connected to Merlonix with severity: warning and above
  • No client-facing Slack channels — use email to notify clients on critical-only events

Agency with dedicated account managers per client

  • One internal #monitoring channel for the full team
  • One private Slack channel per major client, with a webhook set to critical-only

Small agency, 1–5 clients

  • Single Slack channel connected to all alerts
  • Severity: warning and above for everything — small team can handle the volume

Keeping webhooks active

Slack deactivates Incoming Webhooks that have not received requests in 30 days. If you go a month without a critical alert and then one fires, the webhook may have been deactivated.

To keep webhooks active, Merlonix sends a keepalive test every 28 days to any connected Slack channel. If the test fails (the webhook has been deactivated), you receive an email notification to re-enable it.

If you receive this notification, go to Settings → Alert channels, find the Slack channel, click Test, and follow the prompt to regenerate the webhook if needed.

Troubleshooting

Alert fires in Merlonix but Slack message does not arrive: Check the webhook URL in Settings → Alert channels. Visit the Slack API dashboard and confirm the webhook is still active under your app's Incoming Webhooks settings.

Receiving too many alerts: Increase the severity filter to Critical only. Warning-level alerts for gradual expiry can accumulate when monitoring a large portfolio. Reduce noise by handling warnings in Merlonix and reserving Slack for critical-only events.

Not receiving any alerts: Confirm at least one asset has an active monitoring schedule. Navigate to an asset and click Run check to trigger a manual check. If the result is warning or critical and you have a matching Slack channel with the correct severity filter, an alert should fire.

Related: