Expired certificates still take sites down
An expired TLS certificate is a full outage. Automate renewal and watch every certificate from outside.
Big companies still go down because a certificate expired. For the visitor it looks like a hacked site: a full-page browser warning. For an API it’s a hard failure.
It happens because nobody owns the date. The person who installed it left, the reminder went to an old inbox, and the certificate on the load balancer was never part of the automation.
How I avoid it:
- Automate renewal with ACME (Let’s Encrypt or your provider’s equivalent). Manual yearly renewals are where it goes wrong.
- Make a list of every certificate: websites, APIs, mail servers, VPN, load balancers, internal tools.
- Monitor from outside. A simple check that alerts 21 days before expiry catches what the automation missed.
- Test the renewal, not just the setup. A renewal that fails silently is the same as no renewal.
- Send expiry emails to a shared address, never a person.
Certificate lifetimes are only getting shorter. If it isn’t automated now, it will hurt more next year.