Certificate Management - Renewal Tasks not generating

[Joe126]

Hi,

We want to use Certificate Management for managing certs.  At this time we are not implementing discovery or connecting to Certificate Authorities.  We are going to use the bulk upload process and then just want use the "management" aspect.  Getting renewal tasks created and assigned to groups/individuals. dashboards, etc.
In testing, I uploaded a bunch of dummy certs and cannot get any renewal tasks generated when I manually trigger the Certificate Notification and/or Certificate Event Notification jobs.
I did notice that for expired certs, a task is generated and incident created.   
I did fill out what I believe are the fields necessary - assigned to, change group, approval group, managed by, etc.

What am I missing?  

[BennyCanuck]

I recently started experiencing an issue that may or may not be related to what you're describing.

TLDR: The manual renewal tasks had been working well for us until recently. We updated to Certificate Inventory and Management version 4.2.0 a couple of months ago and only recently noticed that not all expiring certificates are getting a renewal task created when they should.  I'm still actively troubleshooting as to why.  If I execute the same code in a background script the renewal task is created, but not when executing the OOB scheduled job.  I don't have a resolution yet, but see there's two newer updates available, 4.2.4 and 4.3.0 so I'll be installing these in Dev and retesting.

Read on if you like experiencing someone's frustration second hand:
 
One of my clients is using certificate management in the way you're describing.  No automated renewal at this point, just generate a manual task for renewal when active certificates are nearing expiration. 
This is triggered from a daily scheduled job named "Certificate Notification" as someone had previously mentioned. 
Not related to this issue, but for some reason there is a second daily scheduled job named "Certificate Event Notification" which calls the same function in the same extended script include as the other scheduled job.  No idea why there's two jobs in this instance, but they both seem to be out of box, I had previously disabled one to improve system performance because cert mgmt in general is already horribly inefficient.

Ensuring this scheduled job is enabled and running, while also setting the unique certificates to create renewal tasks, SHOULD be all that you need to do for this to generate your manual renewal tasks in the 60 days leading up to expiration via the "Certificate Notification" subflow.  This was working, then it wasn't.

The daily scheduled job had historically been working well, every day it would create manual renewal tasks for certificates expiring within the window which did not yet have any tasks created for them.
As someone else had previously mentioned, there is unfortunately no "active" filter on the subflow when looking for tasks. If ANY manual flow renewal task is associated with the certificate, it will skip creation.  This is unfortunately NOT a query performed within the script include called by the scheduled job prior to invoking the subflow, so depending on how many expiring certificates you have in your CMDB this subflow may be called 100's of times daily at the scheduled time, only to end the flow after realizing there's already a renewal task created.
It also does not include a query for certificates configured to "Do not create renewal tasks" so these certs also trigger a call to the subflow daily.  If you're wondering why your flow context logging spiked after installing Cert Mgmt, this is why.  At least they've finally excluded Retired certificates from the results, so we weren't getting renewals created for certificates that are no longer in use.

These could have been added in the query in the base script include to reduce the number of calls to the subflow.
Or better yet, do away with the scheduled job entirely, schedule the daily check for expiring certificates using a Flow, which queries the records and then directly calls the subflow.  This would be SO MUCH EASIER to troubleshoot this type of issue if we could review the flow execution context instead of needing to jump around from a Scheduled Job, to a script include, which calls a function in an extended script include, which then uses the flow API to call the subflow.