AHexagon Systems Journal

Certificates are a lifecycle

A valid certificate is not a finished task. It begins an operational lifecycle involving challenge reachability, scheduled renewal, safe reloads, expiry monitoring, and recovery from failed automation.

Validate the prerequisites

Before issuance, compare the public DNS answer with the intended endpoint. Confirm that the challenge path is reachable from outside and that an unrelated redirect or access rule does not intercept it. Automation should stop when these assumptions are false.

After issuance, inspect the subject alternative names and validity period from the public endpoint. A file on disk is not evidence that the active service loaded it.

Exercise renewal early

A renewal dry run demonstrates that credentials, challenge routing, and reload hooks still agree. Schedule it while the current certificate has ample lifetime remaining, not during the final hours before expiry.

Keep the previous valid material until the replacement is complete and the service has passed an external TLS check. A deployment should never replace working credentials with an incomplete result.

Monitor what visitors see

Expiry alerts should inspect the public service, not only a certificate directory. This catches stale processes, incorrect virtual hosts, and load balancers that continue to present an older certificate.