Receive signed certificate events.

Signature

Webhook bodies are signed as timestamp plus request body with HMAC-SHA256. Receivers should reject old timestamps and mismatched signatures before acting on the payload.

• Verify against the raw request body.
• Reject stale timestamps before processing the event.
• Rotate secrets when receiver access changes.

import crypto from "node:crypto";

function verifyWebhook({ rawBody, timestamp, signature, secret }) {
  const signed = `${timestamp}.${rawBody}`;
  const expected = crypto.createHmac("sha256", secret).update(signed).digest("hex");
  const actual = signature.replace(/^sha256=/, "");
  return crypto.timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(actual, "hex"));
}

Replay tolerance

Use the timestamp header to reject stale deliveries outside the documented tolerance window. Store recent delivery identifiers if your receiver needs stronger idempotency.

Retries

Temporary HTTP or network failures retry on the alert delivery schedule. Permanent validation failures and repeated delivery failures become visible in delivery logs.

Payload fields

Events include monitor identity, event type, severity, relevant certificate fields when available, and the channel setting that triggered delivery.

• Use monitor identity to connect the event to inventory.
• Use severity to decide whether the receiver should create a ticket or update state.
• Use certificate fields when available to avoid a second lookup.