Keeping TLS certificates boring
An expired certificate is one of the most common reasons a small business site suddenly shows a scary browser warning. It is also one of the easiest problems to prevent.
Automate renewal
Free certificates from an ACME authority last 90 days. Renewal should run automatically, well before expiry, and the web server should reload the new certificate without manual steps.
Monitor from outside
Automation fails silently. A simple external check that warns you 14 days before expiry catches broken renewals in time.
Check once a month
We look at expiry dates, redirect from HTTP to HTTPS, and that all host names on the certificate still point to the right server.