Use this page for a weekly expiry sweep, when an expiry warning arrives, or when an outage smells like TLS. Certificate expiry is one of the most common and most preventable causes of outages.
Know every kind of certificate you own
| Kind | Where it lives | Renews itself? |
|---|---|---|
| Public TLS from a managed CA (for example ACM with DNS validation) | Load balancers, CDN | Yes, if validation records still exist |
| Imported TLS certificates | ACM imported, web servers | No |
| Private CA or mTLS client certs | Service mesh, partner integrations | Depends |
| Vendor and partner certificates (portal logins, signing certs) | Vendor portals | No, and usually a manual portal process |
| Code-signing and SAML signing certs | CI, identity provider | No |
| SSH host keys and CA | Bastions | No |
Keep an inventory with owner, expiry date, where it is installed and the renewal runbook link.
Sweep for expiry
# ACM, per region (read-only)
aws --profile <readonly-profile> --region <region> acm list-certificates \
--includes keyTypes=RSA_2048,EC_prime256v1,RSA_4096 \
--query 'CertificateSummaryList[].{arn:CertificateArn,domain:DomainName,notAfter:NotAfter,renewal:RenewalEligibility,type:Type}' \
--output table
# Any endpoint, from outside
echo | openssl s_client -connect <host>:443 -servername <host> 2>/dev/null \
| openssl x509 -noout -subject -enddate
- Alert at 30 days, page at 7 days.
- AWS Health also sends ACM renewal problems; route those events to the team.
Why managed renewals fail
- The DNS validation CNAME was deleted. Recreate it from the certificate's details.
- The certificate is not in use, so the CA does not renew it. Delete it if truly unused.
- A CAA record blocks the CA.
- It is an imported certificate. Those never auto-renew.
Run a manual renewal safely
- Get the new certificate (CSR from a key generated where it will live; never email private keys).
- Check the chain and the key match before touching production.
- Install on a non-production endpoint first, or add it alongside the old one.
- Swap in production during a change window, through the change process.
- Verify from outside, then remove the old certificate after a day.
# Key and cert match? The two hashes must be equal
openssl x509 -noout -pubkey -in cert.pem | openssl sha256
openssl pkey -pubout -in key.pem | openssl sha256
# Full chain verifies?
openssl verify -CAfile chain.pem cert.pem
Rollback
Keep the old certificate installed or re-importable until the new one has carried traffic for 24 hours. Rollback is re-attaching the old one, which only works while it is still valid, so renew at least two weeks early.
Pitfalls
- Renewing the certificate but not the intermediate chain.
- Vendor portal renewals owned by someone who left. Name an owner and a backup for each.
- Pasting private keys into tickets or chats. Keys move only through a secret manager.