What happens when a monitored certificate approaches expiration in Venafi?

Venafi tracks each certificate's expiration date against configurable thresholds — commonly set at, say, 60, 30, and 7 days out — and takes escalating action as those thresholds pass.

If the certificate is covered by an automated renewal policy and the target endpoint has a supported orchestration connector (an F5 device, an IIS server, a load balancer), Venafi can renew and re-provision it automatically without anyone intervening. If it isn't fully automated — say, a third-party vendor's system Venafi can only monitor, not push to — it instead fires notifications to the certificate's assigned owner and any configured alert channel (email, Slack, ticketing system) with escalating urgency as the deadline nears.

Everything is logged, so even a certificate that does eventually expire generates a clear audit trail showing when warnings went out and who was notified, rather than the expiration being a silent surprise discovered only when the outage call comes in.