How do I monitor server certificate expiry and renewal health?
Monitor the certificate clients actually receive, along with the renewal process that is supposed to replace it. A renewed file on disk does not prove a proxy or application has loaded that file. Include every relevant hostname and TLS termination layer.
Before you start
- A hostname and endpoint inventory, certificate owner and access to renewal status or logs.
Instructions
1. Inventory the served certificates
Check public websites, APIs and other TLS services, including separate origin and edge endpoints. Validate hostname, trust chain and expiry using an appropriate client. When a hostname has multiple serving addresses, account for different nodes presenting different certificate versions.
2. Track renewal and deployment
Confirm that the scheduled renewal runs, domain validation succeeds and the application reload or deployment step completes. Review errors rather than relying on the timer being enabled. Protect DNS validation credentials and include changes to routing or firewall policy in renewal troubleshooting.
3. Choose actionable warning periods
Set warnings far enough ahead to allow investigation, domain-control recovery and a supported maintenance change. Confirm the alert destination and escalation route. After renewal, verify the externally served certificate’s new expiry and serial or fingerprint, not only a success message from the certificate client.
Check the result
- Every required endpoint presents a valid certificate and has a functioning renewal owner.
- A renewal test or completed renewal is followed by verification of the served certificate.
Troubleshooting
- Renewal succeeded but monitoring still shows the old expiry
- Check the selected certificate file, web-server reload, load-balancer nodes and the actual endpoint reached. The renewed file may not be the certificate currently in use.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.