# Options to create alarm if device certificate(thin-edge) is about to expire

**URL:** <https://community.cumulocity.com/t/options-to-create-alarm-if-device-certificate-thin-edge-is-about-to-expire/15022>\
**Category:** Forum\
**Tags:** Streaming-Analytics-Apama, thin-edge-io\
**Created:** [July 14, 2026, 9:51am UTC](https://community.cumulocity.com/t/options-to-create-alarm-if-device-certificate-thin-edge-is-about-to-expire/15022 "2026-07-14T09:51:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christof\_Strack](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christof_strack/32/30066_2.png) [@Christof\_Strack](https://community.cumulocity.com/u/Christof_Strack)\
**Post date:** [July 14, 2026, 9:51am UTC](https://community.cumulocity.com/t/options-to-create-alarm-if-device-certificate-thin-edge-is-about-to-expire/15022/1 "2026-07-14T09:51:47Z")

</div>

Hi,

What are the considerations for implementing either of these solutions for the following use case?

- **thin-edge uses :** X509 certificates, that expire after X months.

- **Renewal window:** The certificate must be renewed Y days before its expiration date. If this renewal does not happen, an alarm must be generated.

- **Failure handling:** The renewal may fail under certain circumstances (e.g., if the device is offline for an extended period).

**Proposed Solution A:** Use an **Apama Streaming Analytics** rule that checks once a day to see if any certificate is reaching its renewal threshold and generates an alarm.

**Proposed Solution B:** Use a rule defined directly in **thin-edge** that is evaluated once a day.

Regards Christof

---

<div class="post-metadata">

**Author:** ![Stefan\_Witschel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/stefan_witschel/32/31955_2.png) [@Stefan\_Witschel](https://community.cumulocity.com/u/Stefan_Witschel)\
**Post date:** [July 14, 2026, 10:48am UTC](https://community.cumulocity.com/t/options-to-create-alarm-if-device-certificate-thin-edge-is-about-to-expire/15022/2 "2026-07-14T10:48:25Z")

</div>

There is actually a pre-defined flow doing exactly that:

> **[tedge-flows-examples/flows/certificate-alert at main ·...](https://github.com/thin-edge/tedge-flows-examples/tree/main/flows/certificate-alert)**
>
> main/flows/certificate-alert

It runs locally and triggers an alarm in C8Y when reaches the tresholds which are configurable via Parameter Management.