Security
TLS certificate renewal: replace a certificate without an HTTPS outage
TLS certificate renewal is an automated operational workflow: prove domain control, obtain a replacement, install it in the correct service, reload without breaking traffic, and verify the new certificate externally. The job is not finished because an ACME command printed “success.”
Know the validation method and dependency
HTTP-01 depends on public DNS and an accessible challenge path; DNS-01 depends on authoritative DNS automation; other methods have their own constraints. Record which account, credentials, and DNS/web path the renewal client uses.
A proxy or CDN can affect whether the challenge reaches the intended origin.
Renew before the emergency window
Run automated renewal checks regularly and alert well before expiry. Short-lived certificates are designed around reliable automation, not calendar reminders from a human.
Test renewal in staging where the CA supports it if you are changing the automation itself.
Install/reload every service using the certificate
Web servers, SMTP, IMAP, control panels, reverse proxies, and application gateways may use separate file paths or reload hooks. Inventory consumers so one service does not keep serving the old certificate after renewal.
Use config tests before reload when available.
Verify from outside
Check hostname, issuer, chain, expiry, and certificate fingerprint from an external connection after renewal. Keep logs for failed attempts and monitor days-to-expiry independently.
- Document challenge method.
- Alert before expiry.
- Reload all certificate consumers.
- Verify the served certificate externally.