Engineers remember Let's Encrypt. Fewer remember the registrar invoice. Both calendars end in "nobody can reach us," but the debugging story differs.
SSL expiry
Browsers warn; API clients fail handshake. HTTPS monitors go red. Catch it early with 30/14/7 day warnings. Automation helps; monitoring automation is still required.
Domain expiry
The name stops being yours in the DNS system of record. Resolution fails or points somewhere grim after redemption periods. HTTP monitors fail too, usually as DNS errors, while someone digs through app logs.
Domains often renew yearly. The person with the registrar login may have left the company. Cards expire. Lock status and WHOIS privacy hide the problem until it is expensive.
Practical controls
- List every production domain and who owns the registrar account.
- Turn on auto-renew and a calendar reminder 60 and 30 days out to a shared inbox.
- Monitor DNS resolution for critical names if you can (DNS monitoring).
- Prefer registrars that email multiple contacts.
- Document transfer unlock steps before you need them in a panic.
During an incident
If everything fails at once across unrelated services sharing a domain, check DNS and registration before restarting pods. Soft 404 park pages after expiry are a special hell; they can even look like 200s to naive checks.
Two calendars. Two owners if needed. One outcome if either is ignored: silence where your product used to be.
