What to know
- Assign an owner and an independent alert destination.
- Check domain validation and renewal automation before expiry.
- Confirm the public service presents the renewed certificate.
Assign ownership before the expiry date
A certificate deserves a named owner, a renewal method and a monitored outcome. Start with an inventory of the main website, www, customer portal, API and other public TLS endpoints. Our suggested record includes the hostname, certificate provider, automation owner and escalation contact. Record what is actually deployed rather than assuming every name uses the same certificate.
Do not depend on an expiry email
Let’s Encrypt has ended its expiration email service. Maintain your own monitoring and alert destination. Set checks early enough to investigate a failed renewal and test the notification path. A useful alert names the affected hostname and the person expected to act; an unread shared mailbox is not a complete operating process.
Keep domain validation working
Certificate automation must continue to prove control of the domain. Let’s Encrypt documents the validation methods, including HTTP-01 and DNS-01. HTTP-01 requires the challenge path to be reachable on port 80; DNS-01 requires the appropriate TXT response and supports wildcard certificates. Choose the method that fits your hosting arrangement and review changes to DNS, access rules or proxy routing before they break renewal.
Test automation and deployment separately
Certbot’s renewal guide describes testing renewals with a dry run and using deployment hooks when an application must load the renewed certificate. Other control panels have their own mechanisms; follow the tool that owns your installation. Successful issuance is distinct from the public service presenting the replacement. Verify both, including any load balancer or CDN in the path.
Close the loop from outside the server
Our acceptance check opens the real HTTPS hostname from outside the host, checks name coverage and expiry, then exercises sign-in and a representative form. Repeat after a domain move or certificate configuration change. Keep a record of the last successful renewal and the last successful external check. Our DNS migration checklist helps coordinate related changes. When requesting a hosting review, include the endpoint inventory so certificate ownership and monitoring are clear from the start.
Sources & further reading
Primary sources supporting this article. The practical recommendations are Kiava’s general guidance and should be adapted to your project.