Chapter 19
Inventory, expiry and renewal
Every certificate expires and lifetimes keep shrinking, so you need an inventory, an owner for each certificate, monitoring of what servers really send, and automated renewal.
Topic
Lifecycle and automation
Every certificate expires, and public TLS certificates are getting much shorter lifetimes. Expired certificates are still a common cause of outages.
This hub covers keeping an inventory, renewing in time, automating with ACME (certbot, cert-manager, win-acme) and the dated schedule of shorter lifetimes, plus the expiry errors each tool prints.
Understand it: handbook chapters
Plain words first, then the real mechanism, what it looks like at work and why it matters.
Chapter 20
ACME and the 47-day schedule
ACME lets software prove control of a name, then fetch, renew and install certificates automatically: the only practical way to live with very short certificate lifetimes.
Chapter 11
Proving you own the name: DV, OV, EV and CAA
Before issuing, a CA checks that you control each name, using a file, a DNS record or a TLS response, and reads CAA records; OV and EV check the organisation.
Do it: how-to guides
Step-by-step, with real commands and a way to check it worked.
How to check when a certificate expires, and monitor it
You will have read expiry dates in files, live servers and certificate stores, and set up a check that warns before any certificate in a chain runs out.
How to get and renew Let's Encrypt certificates with certbot
certbot gets a Let's Encrypt certificate for your Linux server, installs it, renews it automatically on the CA's schedule, and reloads your web server each time.
How to automate certificates in Kubernetes with cert-manager
cert-manager issues Let's Encrypt certificates for your Kubernetes Ingresses or Certificate resources, stores them in Secrets and renews them before they expire.
How to automate certificates on Windows with win-acme
win-acme gets Let's Encrypt certificates for your IIS sites, binds them, and renews them every day from a scheduled task that follows the CA's renewal advice.
How to get a wildcard certificate with DNS-01
You will have a publicly trusted certificate for *.example.com and example.com, issued through the ACME DNS-01 challenge with a narrowly scoped DNS key, and renewing by itself.
How to prepare for short-lived certificates: a checklist
You will have a dated plan that moves every public TLS certificate to automated renewal, with an inventory, owners, ARI, independent monitoring and a budget, before lifetimes shrink.
Fix it: error pages
The exact messages tools and browsers print, with likely causes and safe fixes.
Check yours: browser tools
They run in your browser. Nothing you paste is sent anywhere.
Tool
Lifetime calendar
See how long a certificate may live on any date, and when to renew.
Tool
Certificate decoder
Paste a PEM certificate and read every field in plain words.
The big picture: crash course
Short lessons of about nine minutes each, with check questions.
Look it up: glossary terms
Every term in plain words, linked to its full entry.