Expired TLS is a boring outage. Browsers show a scary interstitial. API clients refuse to connect. Mobile apps fail in ways that look like "our backend is down." Nobody feels clever afterward, because the expiry date was sitting in the certificate the whole time.
Why auto-renewal is not enough
Let's Encrypt and managed certs fixed the old calendar problem. They did not remove the new one: renewal jobs fail when DNS challenges break, rate limits trip, a CNAME drifts, or someone revokes access to the DNS API. The certificate that was "automatic" becomes a landmine with a date on it.
If you only find out at expiry, your monitoring was not watching the clock.
A cadence that leaves room to act
- 30 days out — notice in the team channel. Plenty of time for routine renewal.
- 14 days out — treat it as a real task. If automation should have renewed by now, something is wrong.
- 7 days out — on-call or owner must intervene. Manual renewal path ready.
- 1 day out — page like a production incident. It is one.
You can implement this with a dedicated SSL monitor, or by watching HTTPS carefully and parsing expiry where your tool supports it. Either way, the human process matters more than the product logo.
Inventory is the unglamorous half
List every hostname customers hit: apex, www, api, app, status, vanity domains, partner CNAMEs. Wildcard certs are convenient and also a single blast radius when renewal fails.
Check the chain, not only the leaf. Missing intermediates break picky clients while Chrome on your laptop still looks fine — a cousin of the "200 OK but still down" problem.
What to do when the warning fires
- Confirm which cert and which host.
- See whether the ACME or vendor renewal ran.
- Fix DNS or API credentials if that was the break.
- Renew manually if needed, then verify from outside your network.
- Write down why automation failed so the next 30-day warning is quieter.
HTTPS uptime checks will catch a fully expired cert as downtime. That is the backstop, not the plan. The plan is to get the email while you can still fix it in daylight.