Certificate outages happen because nobody knew a certificate existed, nobody owned it, or a renewal failed silently. The fix is an inventory, a named owner for each certificate, automated renewal, and alerts that fire long before expiry. With lifetimes shrinking, the old spreadsheet approach will not hold.
Why this keeps happening
Certificates are issued by one team, installed by another, and forgotten when the person who created them leaves. They also hide in places that are not on the main infrastructure list: vendor portals, a marketing landing page, a payment callback host, a forgotten test endpoint that a partner still uses.
On top of that, the public maximum lifetime is falling. The CA/Browser Forum ballot SC-081v3 reduces it from 398 days to 47 days, finishing in March 2029. Read how to prepare for 47 day certificates.
Step 1: build the inventory
Gather certificates from every source you can reach:
- Your DNS zone, to list every host name that exists.
- Load balancers, CDNs, API gateways and ingress controllers.
- Servers and appliances such as VPN gateways and mail servers.
- Third party services using your domains.
- Internal CAs, if you run one.
- Certificate transparency monitoring, which shows public certificates issued for your names. See certificate transparency logs.
For each, record host names, issuer, expiry date, where the private key lives, how it renews and who owns it.
Step 2: assign owners
An owner is a person or team that gets the alert and can act. A shared mailbox that nobody reads does not count. Review owners when people change roles.
Step 3: automate what you can
Move anything on public CAs to ACME or a provider managed renewal. See certificate renewal automation with ACME. For appliances that cannot automate, put a reverse proxy in front that can, or add a calendar reminder tied to a ticket, not to one person's inbox.
Step 4: alert at several points
Alert early enough for a human to fix a broken renewal. Let's Encrypt advises monitoring that tells you when renewals do not happen as expected. A practical pattern: a warning when a certificate is past two thirds of its lifetime without renewing, and a page when under a few days remain.
Probe from outside, too. Connect to each endpoint and read the certificate it actually serves. A renewed file on disk does not help if the service never reloaded.
Step 5: rehearse
Pick one non-critical certificate and let the process run on a schedule that includes a forced failure. Time how long it takes to issue and deploy a replacement by hand.
Quick check
Should I just buy longer lived certificates to reduce the work?
Public CAs are being limited to shorter lifetimes, so that path is closing. Automation is the durable answer.
How do I find certificates I do not know about?
Combine your DNS zone, network scans of your own ranges and transparency log monitoring. Compare the lists.
Sources
Last reviewed: 19 October 2026.
