Addresses and encryption.
WHAT TO KEEP TRACK OF
Domain expiry Certificate expiry Where DNS is managed Which certificates cover which names
WHY EXPIRY MATTERS
Both cause complete outages, and both are entirely preventable.
WHAT TO DO ABOUT DOMAINS
Enable automatic renewal Keep contact details current Enable a registrar lock
WHAT TO DO ABOUT CERTIFICATES
Use automated issuance and renewal Monitor expiry independently
WHY MONITOR SEPARATELY
Automated renewal fails silently more often than expected.
WHAT TO ALERT ON
Certificates within a few weeks of expiry.
WHAT TO CHECK
That every name in use is covered That renewal has actually occurred That intermediate certificates are served correctly
WHAT BREAKS RENEWAL
Changed DNS Blocked validation requests Firewall rules
WHAT TO RECORD
Every domain and certificate, with dates.
WHAT TO TEST
The site from outside, after any change.
