Certificates: the outage you can put in your calendar
An expired certificate is the only outage that sends you the date in advance. It still takes sites down every week.
The outage that arrives on schedule
Almost every failure in operations is a surprise. Certificate expiry is not: the date is written into the certificate, visible to anyone who looks, months in advance. It still takes sites down constantly, which tells you something about how monitoring is usually set up.
The failure mode is also unusually severe. Browsers do not show a degraded page; they show an interstitial warning that most visitors will not click through.
Automatic renewal is not the whole answer
Automated issuance has made renewal routine, and it has also made people stop watching. Automation fails quietly for ordinary reasons, and nobody notices until the certificate actually expires.
- The validation check fails because a DNS record or a redirect changed.
- The renewal ran but the new certificate was never deployed to the server that serves traffic.
- One host in a load-balanced set renewed and another did not.
- A certificate on a device or appliance was never part of the automation at all.
- The intermediate chain changed and was not updated, so some clients fail while browsers appear fine.
What to watch
| Check | Why |
|---|---|
| Days remaining | The obvious one; alert well before the last week |
| Chain completeness | An incomplete chain fails for some clients only |
| Hostname coverage | Subdomains and alternative names are often forgotten |
| Every endpoint | Load balancers, staging, APIs, mail servers |
| Protocol and cipher support | Deprecations break older or newer clients |
| Renewal job health | Failing automation is the real early warning |
Keep an inventory
Most organisations have more certificates than they think: the main site, an API, a staging environment, a mail server, an appliance in a cupboard. The one that expires is usually the one nobody remembered owning.
A short list, with an owner and a renewal method per entry, reviewed twice a year, prevents almost all of these incidents.