> Inventory, expiry, renewal and ACME, and how to get ready for much shorter certificate lifetimes. Chapters, guides and fixes in one place. Source: https://pkizerotohero.com/topics/lifecycle-and-automation/ Topic # Lifecycle and automation Every certificate expires, and public TLS certificates are getting much shorter lifetimes. Expired certificates are still a common cause of outages. This hub covers keeping an inventory, renewing in time, automating with ACME (certbot, cert-manager, win-acme) and the dated schedule of shorter lifetimes, plus the expiry errors each tool prints. ## Understand it: handbook chapters Plain words first, then the real mechanism, what it looks like at work and why it matters. Chapter 19 ### [Inventory, expiry and renewal](https://pkizerotohero.com/handbook/certificate-lifecycle/) Every certificate expires and lifetimes keep shrinking, so you need an inventory, an owner for each certificate, monitoring of what servers really send, and automated renewal. - IT ops - Developer - Leader Chapter 20 ### [ACME and the 47-day schedule](https://pkizerotohero.com/handbook/acme/) ACME lets software prove control of a name, then fetch, renew and install certificates automatically: the only practical way to live with very short certificate lifetimes. - IT ops - Developer - Expert Chapter 11 ### [Proving you own the name: DV, OV, EV and CAA](https://pkizerotohero.com/handbook/domain-validation/) Before issuing, a CA checks that you control each name, using a file, a DNS record or a TLS response, and reads CAA records; OV and EV check the organisation. - IT ops - Developer - Leader ## Do it: how-to guides Step-by-step, with real commands and a way to check it worked. ### [How to check when a certificate expires, and monitor it](https://pkizerotohero.com/guides/check-certificate-expiry/) You will have read expiry dates in files, live servers and certificate stores, and set up a check that warns before any certificate in a chain runs out. - Linux - macOS - Windows - Kubernetes ### [How to get and renew Let's Encrypt certificates with certbot](https://pkizerotohero.com/guides/certbot-lets-encrypt/) certbot gets a Let's Encrypt certificate for your Linux server, installs it, renews it automatically on the CA's schedule, and reloads your web server each time. - Linux - nginx - Apache ### [How to automate certificates in Kubernetes with cert-manager](https://pkizerotohero.com/guides/kubernetes-cert-manager/) cert-manager issues Let's Encrypt certificates for your Kubernetes Ingresses or Certificate resources, stores them in Secrets and renews them before they expire. - Kubernetes - Linux ### [How to automate certificates on Windows with win-acme](https://pkizerotohero.com/guides/win-acme-windows/) win-acme gets Let's Encrypt certificates for your IIS sites, binds them, and renews them every day from a scheduled task that follows the CA's renewal advice. - Windows - IIS ### [How to get a wildcard certificate with DNS-01](https://pkizerotohero.com/guides/wildcard-dns-01/) You will have a publicly trusted certificate for \*.example.com and example.com, issued through the ACME DNS-01 challenge with a narrowly scoped DNS key, and renewing by itself. - Linux - Windows ### [How to prepare for short-lived certificates: a checklist](https://pkizerotohero.com/guides/prepare-47-day-certificates/) You will have a dated plan that moves every public TLS certificate to automated renewal, with an inventory, owners, ARI, independent monitoring and a budget, before lifetimes shrink. - Linux - Windows - Kubernetes ## Fix it: error pages The exact messages tools and browsers print, with likely causes and safe fixes. - [Chrome, EdgeNET::ERR\_CERT\_DATE\_INVALID](https://pkizerotohero.com/errors/chrome-err-cert-date-invalid/) - [FirefoxSEC\_ERROR\_EXPIRED\_CERTIFICATE](https://pkizerotohero.com/errors/firefox-sec-error-expired-certificate/) - [OpenSSLverify error:num=10:certificate has expired](https://pkizerotohero.com/errors/openssl-certificate-has-expired/) - [Node.jsCERT\_HAS\_EXPIRED](https://pkizerotohero.com/errors/node-cert-has-expired/) - [JavaCertPathValidatorException: validity check failed](https://pkizerotohero.com/errors/java-certificate-expired/) - [Go, Docker, Kubernetesx509: certificate has expired or is not yet valid](https://pkizerotohero.com/errors/go-x509-certificate-expired/) ## Check yours: browser tools They run in your browser. Nothing you paste is sent anywhere. Tool ### [Lifetime calendar](https://pkizerotohero.com/tools/lifetime/) See how long a certificate may live on any date, and when to renew. Tool ### [Certificate decoder](https://pkizerotohero.com/tools/decoder/) Paste a PEM certificate and read every field in plain words. ## The big picture: crash course Short lessons of about nine minutes each, with check questions. - [Lesson 5: Names, jobs and asking for a certificate](https://pkizerotohero.com/course/names-and-requests/) - [Lesson 9: Running PKI](https://pkizerotohero.com/course/running-pki/) ## Look it up: glossary terms Every term in plain words, linked to its full entry. - [ACME](https://pkizerotohero.com/handbook/glossary/#acme "Automatic Certificate Management Environment: the protocol that lets software request, validate and renew certificates from a CA without a human.") - [ACME challenge](https://pkizerotohero.com/handbook/glossary/#acme-challenge "The test an ACME client passes to prove it controls a domain: HTTP-01, DNS-01 or TLS-ALPN-01.") - [ARI (ACME Renewal Information)](https://pkizerotohero.com/handbook/glossary/#ari "An ACME extension in which the CA tells each client when to renew a certificate, instead of the client guessing.") - [Baseline Requirements](https://pkizerotohero.com/handbook/glossary/#baseline-requirements "The CA/Browser Forum's rules that every publicly trusted TLS certificate authority must follow.") - [CAA record](https://pkizerotohero.com/handbook/glossary/#caa-record "A DNS record in which a domain owner lists the certificate authorities allowed to issue certificates for that domain.") - [Certificate inventory](https://pkizerotohero.com/handbook/glossary/#certificate-inventory "A complete, kept-up-to-date list of the certificates an organisation uses, where they are installed, who owns them and when they expire.") - [Certificate lifecycle](https://pkizerotohero.com/handbook/glossary/#certificate-lifecycle "Everything that happens to a certificate: request, issuance, deployment, monitoring, renewal, and finally expiry, replacement or revocation.") - [Domain validation (DV)](https://pkizerotohero.com/handbook/glossary/#domain-validation "A CA checking that the requester controls a domain name before issuing a certificate for it, by an HTTP, DNS or TLS challenge.") - [Extended validation (EV)](https://pkizerotohero.com/handbook/glossary/#extended-validation "The strictest identity check for public TLS certificates, verifying the legal organisation behind a website.") - [Multi-perspective issuance corroboration (MPIC)](https://pkizerotohero.com/handbook/glossary/#multi-perspective-issuance-corroboration "A CA checking domain validation and CAA from several network locations, so one hijacked network path cannot fool it.") - [Organization validation (OV)](https://pkizerotohero.com/handbook/glossary/#organization-validation "A TLS certificate check that confirms the organisation behind a domain, in addition to domain control.") - [Short-lived certificate](https://pkizerotohero.com/handbook/glossary/#short-lived-certificate "A certificate valid for only days or hours, so that a stolen key stops working soon even if revocation is never checked.") ## Other topics - [Certificates](https://pkizerotohero.com/topics/certificates/) - [Chains and trust stores](https://pkizerotohero.com/topics/chains-and-trust/) - [TLS and HTTPS](https://pkizerotohero.com/topics/tls/) - [Revocation and transparency](https://pkizerotohero.com/topics/revocation-and-transparency/) - [Private PKI](https://pkizerotohero.com/topics/private-pki/) - [Hashes and signatures](https://pkizerotohero.com/topics/signing/) - [Post-quantum cryptography](https://pkizerotohero.com/topics/post-quantum/)