Retry and failure alert

A renewal that fails is retried under the renewal attempt limit (settings, tab General, Max. renewal attempts, default 3, from 1 to 10). Retries between cycles are 15 minutes apart. If the certificate would expire before the next cycle, one attempt is made 5 minutes before expiry. After the limit, the cycle backstop keeps trying once per cycle until a renewal succeeds. If an active target holds a certificate that expires before the next cycle, one immediate attempt is made, see chapter When renewal and deployment run together.

Failure alert, for every renewal, per certificate:

• The first failure sends an alert immediately.
• Retries send no alert.
• When the attempts are exhausted, one alert is sent.
• After that, the cycle backstop sends at most one alert per day.
• A successful renewal clears this. The next failure alerts again as a first failure. The state is kept across a restart, so a restart does not send the same alert twice.

The cycle alert Deployment & health cycle finished with N failure(s) (Notify On, Cycle finished with failures) counts failed deployments and failed health checks only, not a failed renewal. There is no success summary and no line that says a renewed certificate was deployed. Renewal alerts and deployment alerts are separate. Certificate History is the renewal history, Deployment History the deployment history.

The column shows Retry renewal and the time of the next attempt, in red. Once the attempts are exhausted, it shows Retry and the time of the next cycle, in orange.

Renewal failure alert