diff --git a/data/policy_permissions_list/master_policy_permissions_list.json b/data/policy_permissions_list/master_policy_permissions_list.json
index bc40b61630..529e727e3a 100644
--- a/data/policy_permissions_list/master_policy_permissions_list.json
+++ b/data/policy_permissions_list/master_policy_permissions_list.json
@@ -6516,7 +6516,7 @@
     {
       "id": "./operational/azure/azure_certificates/azure_certificates.pt",
       "name": "Azure Expiring Certificates",
-      "version": "4.0.0",
+      "version": "4.0.1",
       "providers": [
         {
           "name": "azure_rm",
diff --git a/data/policy_permissions_list/master_policy_permissions_list.yaml b/data/policy_permissions_list/master_policy_permissions_list.yaml
index 3488cff96b..c3b6f55f46 100644
--- a/data/policy_permissions_list/master_policy_permissions_list.yaml
+++ b/data/policy_permissions_list/master_policy_permissions_list.yaml
@@ -3780,7 +3780,7 @@
       required: true
 - id: "./operational/azure/azure_certificates/azure_certificates.pt"
   name: Azure Expiring Certificates
-  version: 4.0.0
+  version: 4.0.1
   :providers:
   - :name: azure_rm
     :permissions:
diff --git a/operational/azure/azure_certificates/CHANGELOG.md b/operational/azure/azure_certificates/CHANGELOG.md
index cbaf3fac16..d4554d9389 100644
--- a/operational/azure/azure_certificates/CHANGELOG.md
+++ b/operational/azure/azure_certificates/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## v4.0.1
+
+- Fixed issue where policy incident would show incorrect `Days Until Expiration` for several resources
+
 ## v4.0.0
 
 - Added ability to delete Azure certificates automatically or manually
diff --git a/operational/azure/azure_certificates/azure_certificates.pt b/operational/azure/azure_certificates/azure_certificates.pt
index 174654f489..31b6bf7c09 100644
--- a/operational/azure/azure_certificates/azure_certificates.pt
+++ b/operational/azure/azure_certificates/azure_certificates.pt
@@ -7,7 +7,7 @@ category "Operational"
 severity "low"
 default_frequency "daily"
 info(
-  version: "4.0.0",
+  version: "4.0.1",
   provider: "Azure",
   service: "PaaS",
   policy_set: "Expiring Certificates"
@@ -348,7 +348,7 @@ script "js_azure_certificates_expiring", type: "javascript" do
     if (today >= expiration_date) {
       status = "Expired"
     } else {
-      days_until_expiration = Math.round((today - expiration_date) / 86400000)
+      days_until_expiration = Math.round((expiration_date - today) / 86400000)
     }
 
     if (status == "Expired" || days_until_expiration <= param_expiration_days) {
diff --git a/operational/azure/azure_certificates/azure_certificates_meta_parent.pt b/operational/azure/azure_certificates/azure_certificates_meta_parent.pt
index d2d9eb9971..be2b3e0846 100644
--- a/operational/azure/azure_certificates/azure_certificates_meta_parent.pt
+++ b/operational/azure/azure_certificates/azure_certificates_meta_parent.pt
@@ -7,7 +7,7 @@ category "Meta"
 default_frequency "15 minutes"
 info(
   provider: "Azure",
-  version: "4.0.0", # This version of the Meta Parent Policy Template should match the version of the Child Policy Template as it appears in the Catalog for best reliability
+  version: "4.0.1", # This version of the Meta Parent Policy Template should match the version of the Child Policy Template as it appears in the Catalog for best reliability
   publish: "true",
   deprecated: "false"
 )