Deploys as a managed application in your own subscription. No vendor backend, no data egress.
Flat monthly fee, billed by Microsoft.
The gap
An expired TLS certificate takes production down hard, and the places certificates actually live in Azure, Application Gateway listeners and trusted roots, App Service uploads, API Management, have no native expiry alert. Teams find out from customers.
What it does
Covers Application Gateway frontend and backend certificates, App Service certificates, and API Management certificates.
Reports expired, expiring within your thresholds (default 30, 14, 7, and 1 days), and could-not-read certificates, which is itself a signal.
Re-reports every day until a certificate is renewed, so an ignored warning escalates rather than disappears.
Decodes Application Gateway certificate bundles correctly (they are PKCS7, not bare X.509) and reads the leaf expiry.
Reads only certificate metadata and public certificate data through the management plane. Private keys are never touched.
The daily digest: expired, expiring, and unreadable certificates across every covered store.Per-certificate detail with the resource, listener, and days remaining.Thresholds and the Teams destination are plain app settings.
Honest about its limits
Key Vault certificates are deliberately out of scope; Key Vault already emits expiry events and our Key Vault Expiry Digest covers them properly.
Front Door and CDN managed certificates are excluded because Azure rotates and alerts on those itself.
Read-only. This app reports and alerts; it changes nothing in your subscription.
How it runs, and what it needs
A serverless function on a schedule, with a system-assigned managed identity, deployed into your subscription
by the Azure Marketplace. Roles are granted by you after deployment with the one-line script in the package, so
nothing runs until you say so. Every role it asks for, and why:
Reader
enumerate gateways, App Service certificates, and API Management certificates and read their public data
Alerts go to the Teams webhook you configure. Nothing is sent anywhere else.
FAQ
Does any data leave my subscription?
No. The function runs in your subscription and writes only to your configured alert destination. Katabarwa Labs operates no backend and receives nothing.
How is it billed?
A flat monthly fee on your Azure bill through the Marketplace, plus the small consumption cost of the function itself. No per-resource or per-user pricing.
How do I remove it?
Delete the managed application from the Azure portal. Its resource group and identity go with it, and any role you granted can be removed the same way.
