Managing client SSL certificates without chasing renewals

Managing a fleet of client certificates comes down to knowing the moment one stops renewing itself, on any client, before it expires. Most renew themselves — Let’s Encrypt every 90 days, commercial certificates yearly — and as the industry moves to shorter lifetimes there will only be more renewals to keep track of.

A renewal still fails quietly when a validation breaks, a rate limit is hit, a cron job stops, or the new certificate is issued but the web server is never reloaded to serve it. The renewal logs say success while the countdown keeps running, and with a short validity window a stalled renewal has little room before it becomes an outage.

What to watch per client is the same short list every time: the expiry date read from the certificate the server actually serves, the full chain including intermediates, whether the hostname and SAN still match, and any unexpected change to the certificate. Around that sit the domain-registration expiry — a different clock from the certificate — and the mail and admin ports that hold their own certificates. A check that reads all of this from outside catches the renewal that did not take effect long before the client does.

Whether to tell the client or just fix it comes down to timing. With alerts landing days ahead on a ladder — a month, a fortnight, a week, a day — most issues are handled quietly during business hours, and the client only hears from you when there is genuinely something they need to do.