How do you configure automated remediation for expiring certificates in Venafi?

Automated remediation in Venafi is built as a policy-driven workflow attached to a certificate object or its owning folder/zone, rather than a single global switch, since different certificates need different responses.

1. Define the trigger — typically a threshold like "30 days before expiry," but it can also be an event like a discovered policy violation or a detected weak key.
2. Choose the action: fully automated renewal and re-provisioning for endpoints with a supported orchestration connector, or a notification-and-approval workflow when a human needs to review the change first (common for production-critical systems).
3. Attach the workflow to the right scope — a policy folder or zone, so every certificate underneath inherits the same remediation behavior without configuring each one individually.
4. Set escalation rules for what happens if the automated step fails or nobody responds to a manual approval request in time, so a stuck workflow doesn't silently do nothing until the deadline passes.

The key design point is that "automated remediation" doesn't have to mean "fully hands-off" everywhere — it's common for a mature deployment to auto-renew low-risk internal certificates while routing anything customer-facing or regulated through an approval step first, all within the same platform.