What changed
Certificates used to be bought annually, installed by hand, and diarised. They lasted a year or more, the renewal was a purchase, and somebody owned it.
Now most certificates last around ninety days and renew themselves, usually through Let's Encrypt or a hosting platform. This is a straightforward improvement: shorter lifetimes limit the damage from a compromised key, and automation removed the most common cause of expiry, which was a human forgetting.
What it created
A process that works silently for years, understood by nobody currently at the company.
The renewal runs somewhere: a timer on a server, a control panel setting, a platform that handles it invisibly, a proxy in front of everything. Whoever configured it knew where. Two migrations and one departure later, nobody does.
How it actually breaks
- A server migration leaves the renewal job behind on the old machine, which is still running and still renewing a certificate nobody serves.
- A hostname is added to the site and never added to the certificate, so it works until a visitor uses that name.
- A configuration change breaks the challenge the renewal depends on, and the failure is a log entry on a machine nobody reads.
- Someone installs a certificate by hand for one subdomain, and that one has no automation at all.
The signal to pay attention to
If a certificate has around ninety days of life, it is automated, and an expiry warning does not really mean the certificate is a problem. It means the renewal has stopped and the certificate is simply where you noticed.
Renewing by hand and moving on is the wrong response, because it will happen again in ninety days. The task is finding where the renewal runs, which is harder and is the actual finding.
The one that hides best
Separately from expiry: an incomplete chain works in your browser and fails for others, because your machine cached the missing intermediate and theirs did not. It is the only certificate failure that is invisible to the person checking, which is why it can run for months.