Keeping TLS certificates boring

Automatic certificate renewal has made expired certificates rare, but not impossible. When renewal fails silently, the first warning is often a customer's screenshot of a browser error.

What we set up for every client

Renewal runs from a timer, not from someone's memory. A deploy hook reloads the web server so the new certificate is actually used. And a separate check, from outside the server, looks at the expiry date every day.

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate

The alert

If fewer than twenty days remain, someone gets an email. Renewal normally happens at thirty, so an alert means something is broken, and there are still three weeks to fix it calmly.

← All posts