From 317bb2f76a423cc0ad45d0b2168fd5f52dac72a1 Mon Sep 17 00:00:00 2001
From: Panos Rontogiannis <pronto@admin.grnet.gr>
Date: Thu, 5 Jan 2023 12:41:07 +0200
Subject: [PATCH] add comment for BlackboxSslCertificateExpired rule

---
 _data/rules.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/_data/rules.yml b/_data/rules.yml
index 32f8eb1..024e3fa 100644
--- a/_data/rules.yml
+++ b/_data/rules.yml
@@ -399,6 +399,11 @@ groups:
                 description: SSL certificate has expired already
                 query: 'probe_ssl_earliest_cert_expiry - time() <= 0'
                 severity: critical
+                comments: |
+                  For probe_ssl_earliest_cert_expiry to be exposed after expiration, you
+                  need to enable insecure_skip_verify. Note that this will disable
+                  certificate validation.
+                  See https://github.com/prometheus/blackbox_exporter/blob/master/CONFIGURATION.md#tls_config
               - name: Blackbox probe slow HTTP
                 description: HTTP request took more than 1s
                 query: 'avg_over_time(probe_http_duration_seconds[1m]) > 1'