Anomaly-only certificate alerts

If your monitoring tool emails you for every certificate renewal, you will stop reading the emails. That is how real incidents get missed.

Our notification principle

Good Roots Work should only surface issuance that looks abnormal relative to:

• Public CAA in DNS (when present)
• Private CAA policy you define in the tenant app (overrides public policy for analysis)
• Issuance history — prior CAs, name sets, and cadence

Expected renewals from authorised CAs should not page your on-call.

What this means in practice

Event	Typical alert?
Scheduled Let’s Encrypt renewal for www.example.com	No
First cert for payments.example.com from a new CA	Yes
Cert with SANs outside your usual pattern	Yes
Issuance from a CA not permitted by CAA	Yes

Get started

Start free or read the product page.