Your certificate will expire on a Saturday

It’s a law of nature. Certificates expire on weekends, around 2 a.m., while the person who renewed it last year is on a beach with no signal.

A calendar reminder won’t save you. Calendar reminders get snoozed. What saves you is making renewal something nobody has to remember.

Know what you have

Start with an inventory: every certificate, who issued it, where it’s deployed, and when it dies. Most cert incidents I’ve seen came from one nobody knew existed, attached to a load balancer someone set up “temporarily” years ago.

Let ACM do the work

Certificates issued by AWS Certificate Manager with DNS validation renew on their own, as long as the validation CNAME stays put. Imported certificates never renew. Treat every imported cert as a pager alert with a countdown.

Alert like you mean it

ACM publishes a DaysToExpiry metric to CloudWatch and sends an approaching-expiration event to EventBridge well ahead of time. Alarm at 30, 14 and 7 days. The 30-day alarm opens a ticket. The 7-day alarm wakes a human.

Automate the rest

For anything outside ACM, a scheduled job that checks expiry over TLS, renews, and redeploys costs an afternoon to write. The incident it prevents costs a weekend.

My weekends are spoken for. Mostly by sleep.