Incident creation for expired certificates in Certificate Inventory and ManagementSummary<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ServiceNow can automatically create incidents for expired certificates through two separate mechanisms in the Certificate Inventory and Management feature. Understanding both mechanisms helps administrators configure and troubleshoot certificate-related incident creation. System property-driven incident creation The scheduled job 'Certificate Notification' runs daily and calls the script include 'CertificateTaskNotifier'. This script include executes the subflow 'Certificate Notification'. During subflow execution, if a certificate is found to be expired and the system property 'glide.discovery.certs.enableincidentcreationforexpiredcertificates' is set to true, the system creates an incident. An incident is only created if one does not already exist for that specific certificate CI. To locate this property, navigate to System Properties and search for 'glide.discovery.certs.enableincidentcreationforexpiredcertificates'. To locate the scheduled job, navigate to System Definition > Scheduled Jobs and search for 'Certificate Notification'. Event-driven incident creation The scheduled job 'Certificate Event Notification' runs daily. It scans the Certificate CI table (cmdb_ci_certificate) for certificates that are already expired or will expire within the next 60 days. For each qualifying certificate, it creates an event. The event rule 'Certificate Expired/Expiring Events' processes these events and generates alerts and incidents. To locate this scheduled job, navigate to System Definition > Scheduled Jobs and search for 'Certificate Event Notification'. To locate the event rule, navigate to Event Management > Rules > Event Rules and search for 'Certificate Expired/Expiring Events'. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Certificate integrations and notifications