Preventing avoidable outages.
WHY AUTOMATE
Both expiries cause complete outages, and both are entirely predictable.
WHAT TO AUTOMATE FOR CERTIFICATES
Issuance and renewal Reloading the service afterwards Verification that the new certificate is actually served
THAT LAST POINT
Renewal frequently succeeds while the service continues serving the old certificate.
WHAT TO MONITOR SEPARATELY
Expiry, from outside.
WHY SEPARATELY
Automated renewal fails silently more often than expected, and the automation cannot report its own failure reliably.
WHAT TO ALERT ON
A certificate within a few weeks of expiry.
WHAT BREAKS RENEWAL
Changed DNS Firewall rules blocking validation A moved document root An expired account contact
WHAT TO DO ABOUT DOMAINS
Enable automatic renewal Keep payment details current Keep contact details current Diarise expiry independently
WHY INDEPENDENTLY
Automatic renewal fails when a card expires, and the notice goes to an address nobody reads.
WHAT TO CHECK
Every domain and certificate, quarterly.
