Blog

What to actually monitor, why CT-log expiry alerts are noise, and how to survive 47-day certificates without drowning in alerts. A working checklist.

A launch-week outage with no errors in any log: three SSL certificates for one domain, stale DNS caches, and the three days it took to untangle them. A postmortem from memory.

Renewal automation fails silently more often than it fails loudly: the cron exits zero, the logs say success, and the server keeps serving the old certificate. Why it happens and how to catch it.

Certbot exited 0. Disk has a fresh fullchain.pem. openssl on :443 still shows last month's notAfter. Five failure modes, each with one command.

Eight ways to monitor SSL certificate expiry — from a cron one-liner to Prometheus to paid SaaS — compared on the criterion that actually matters: do they check the certificate your server really serves?

Certbot wrote a new fullchain.pem and exited 0. openssl on :443 still shows last month's notAfter. Prove disk vs wire, reload nginx, add a deploy hook.

Certbot needs /.well-known/acme-challenge/ on port 80. A blanket HTTP-to-HTTPS redirect or auth wall returns 404 or unauthorized. Prove the path, carve an exception, renew, then watch expiry off-box.

certbot.timer inactive, masked, or never installed. No renew runs. The leaf on :443 ages until a browser warns. Prove the timer, enable it, then watch expiry off-box.

Certbot has been logging renewal errors for weeks. The notices went to root on a server with no mail relay — or to a journal nobody reads. How to find the errors, read what went wrong, and route alerts somewhere that reaches you.

Let's Encrypt refused the renewal because something already burned the quota. How to read which limit you hit, find the loop that spent it, and get a certificate back on the wire without waiting a week.