SSL Certificate Management Template

Overview

SSL/TLS certificates protect data in transit by encrypting traffic between clients and servers. Expired, misconfigured, or forgotten certificates can cause outages, security warnings, and loss of customer trust. This template provides a process for tracking certificate inventory, planning renewals, deploying certificates, and responding to certificate-related incidents.

When to Use

• For alternatives, see CI/CD Security: Harden Your Pipelines and Prevent Supply.

• Setting up a new domain or public-facing service.

• Migrating from one certificate provider to another.

• Preparing for an audit of security or infrastructure hygiene.

• After a certificate expiry caused an outage or warning.

• Automating certificate lifecycle management with a tool like Let’s Encrypt, Certbot, or a managed certificate service.

Prerequisites

• A list of domains, subdomains, and services that use TLS certificates.
• A certificate authority (CA) or managed certificate provider such as Let’s Encrypt, DigiCert, or AWS ACM.
• A deployment process for updating certificates on load balancers, web servers, CDNs, and containers.
• A monitoring system to alert on certificate expiration.
• Ownership from security, platform, and application teams.

Solution

Template

1. Certificate Inventory

Domain / Service	Certificate Type	Provider	Expiry Date	Auto-Renewal	Owner	Notes
example.com	Wildcard	Let’s Encrypt	2026-09-15	Yes	Platform team	Used on CDN
api.example.com	Standard	DigiCert	2026-12-01	No	API team	Manual renewal
app.example.com	Managed	AWS ACM	Auto	Yes	Platform team	ELB attached
internal.example.com	Self-signed	Internal CA	2027-01-10	No	IT team	Internal tools
cdn.example.com	Standard	Cloudflare	Auto	Yes	Platform team	Edge certificate

2. Certificate Lifecycle Stages

Stage	Activities	Owner	Timing
Request	Identify domain, validate ownership, choose CA	Application or platform team	At provisioning
Approval	Security review, budget approval, CA selection	Security / finance	Before purchase
Issuance	Generate CSR, submit request, download certificate	Platform team	Same day
Deployment	Install certificate on all endpoints and test	Platform team	Same day
Renewal	Request new certificate before expiry	Platform team	30 days before expiry
Revocation	Revoke compromised certificate and replace	Security team	Immediate
Retirement	Remove old certificate from inventory and systems	Platform team	After replacement

3. Renewal Workflow

Step	Action	Owner	Timing
1	Check inventory for certificates expiring within 30, 14, and 7 days	Platform team	Daily
2	Generate or renew certificate with CA	Platform team	30 days before expiry
3	Validate certificate chain and test in staging	Platform team	Before deployment
4	Deploy certificate to production endpoints	Platform team	During maintenance window
5	Verify production endpoint using SSL checkers	Platform team	After deployment
6	Update inventory and renewal log	Platform team	Same day
7	Close renewal ticket	Platform team	Same day

4. Expiry Alert Schedule

Days to Expiry	Alert Channel	Action
60 days	Email to owner	Plan renewal
30 days	Slack or email to team	Start renewal process
14 days	Page on-call if not renewed	Escalate renewal
7 days	Page manager and security lead	Emergency renewal or workaround
1 day	Page executive + incident response	Treat as incident

5. Deployment Checklist

• Certificate and private key are stored securely in a vault or certificate manager.
• Full certificate chain is included during deployment.
• Certificate is deployed on all endpoints: load balancers, web servers, CDNs, and proxies.
• Certificate is tested with tools such as SSL Labs, OpenSSL, or curl.
• Old certificate is removed from configuration after deployment.
• Inventory is updated with new expiry date, serial number, and deployment date.
• Monitoring alerts are confirmed to reflect the new certificate.

6. Incident Response for Certificate Issues

Scenario	Response	Owner
Certificate expired in production	Emergency renew or rollback to previous valid certificate	Platform team + on-call
Certificate misconfigured	Re-deploy correct chain and test all endpoints	Platform team
Certificate compromised	Revoke, replace, and investigate exposure	Security team
Domain validation failure	Re-verify DNS or HTTP validation and retry	Platform team
Auto-renewal failure	Switch to manual renewal and fix automation root cause	Platform team

Explanation

Certificate management is a repetitive operational task that becomes risky at scale. The template centralizes inventory, renewal dates, and deployment procedures so that certificates do not expire unexpectedly. It also links certificate health to monitoring and incident response, making certificate issues easier to detect and resolve quickly.

Certbot Automated Renewal Script

#!/bin/bash
# Renew all Let's Encrypt certificates and reload nginx
set -euo pipefail

CERTBOT=/usr/bin/certbot
WEBROOT=/var/www/certbot
NGINX_CONTAINER=nginx

# Renew certificates
$CERTBOT renew --webroot --webroot-path $WEBROOT --quiet --deploy-hook "docker exec $NGINX_CONTAINER nginx -s reload"

# Check exit code
if [ $? -eq 0 ]; then
  echo "[$(date)] Certificate renewal successful" >> /var/log/certbot-renew.log
else
  echo "[$(date)] Certificate renewal FAILED" >> /var/log/certbot-renew.log
  # Send alert to Slack
  curl -X POST -H 'Content-type: application/json' \
    --data '{"text":"SSL certificate renewal FAILED on $(hostname)"}' \
    $SLACK_WEBHOOK_URL
  exit 1
fi

Kubernetes cert-manager Configuration

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: platform@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
      - http01:
          ingress:
            class: nginx
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: api-tls
  namespace: production
spec:
  secretName: api-tls-secret
  duration: 2160h    # 90 days
  renewBefore: 360h  # 15 days before expiry
  dnsNames:
    - api.example.com
    - www.api.example.com
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer

Certificate Inventory Dashboard Query

-- Prometheus alert: certificate expiring soon
-- Alertmanager rule for cert-manager
SELECT
  domain_name,
  issuer,
  expiry_date,
  owner_team,
  CASE
    WHEN expiry_date < NOW() + INTERVAL '7 days' THEN 'CRITICAL'
    WHEN expiry_date < NOW() + INTERVAL '30 days' THEN 'WARNING'
    WHEN expiry_date < NOW() + INTERVAL '60 days' THEN 'INFO'
    ELSE 'OK'
  END AS status
FROM certificate_inventory
WHERE expiry_date < NOW() + INTERVAL '90 days'
ORDER BY expiry_date ASC;

Variants

• Let’s Encrypt automation: Uses Certbot, acme. sh, or ACME clients with automated renewal and deployment.
• Managed certificate service: Uses AWS ACM, Azure Key Vault, or Cloudflare SSL for fully managed certificates.
• Enterprise CA workflow: Uses internal certificate authorities with approval workflows and domain validation.
• Multi-cloud certificate management: Centralizes certificates across providers using a vault or certificate manager.
• Container-native certificate management: Uses cert-manager or similar tools in Kubernetes.

What Works

• Maintain a single source of truth for all certificates and their owners.
• Automate renewal and deployment where possible.
• Monitor certificate expiry with alerts at 60, 30, 14, 7, and 1 day before expiration.
• Use short-lived certificates with automated renewal to reduce exposure.
• Store private keys and certificates in a secure vault.
• Test certificate deployments in staging before production.
• Document exceptions for certificates that cannot be auto-renewed.
• Include certificate checks in change management and audit reviews.

Common Mistakes

• Relying on manual tracking in spreadsheets without monitoring.
• Forgetting to deploy the intermediate certificate chain.
• Missing certificates on secondary endpoints such as CDNs or load balancers.
• Not updating monitoring after certificate renewal.
• Leaving expired certificates in configuration files.
• Using self-signed certificates for public-facing services.
• Not revoking certificates after a compromise.

Troubleshooting

• Authentication bypass in tests: ensure test users cannot reach production endpoints.
• False positives in scanning tools: tune rules against the risk profile. Distinguish between reachable vulnerabilities and theoretical issues.
• Secrets appear in logs: configure log filters to redact tokens, passwords, and keys. Audit log sinks for sensitive patterns.
• CSP breaks legitimate functionality: use report-only mode first, then enforce. Iterate on allowed sources based on real violations.
• Incident response stalls: run tabletop exercises.

Further Reading

• Official documentation: check the current reference for the framework or tool used.
• Related guides: explore the ssl and tls guides for deeper coverage.
• Complementary patterns: review design patterns applicable to your technology stack.
• Public postmortems: study real incidents from teams that faced similar production issues.

Production Notes

• Deploy gradually using canary or blue-green to catch regressions early.
• Configure alerts for error rate, p99 latency, and failure rate before enabling in production.
• Document the rollback in the runbook; test the procedure in staging at least once per quarter.
• Review structured logs with correlation IDs to trace requests end-to-end during incidents.

Key Takeaways

• Apply ssl certificate management template when you need a practical solution for your use case.
• Monitor performance after implementation; measure latency, errors, and resource usage before and after.
• Check the Troubleshooting section for common failures; most have documented root causes with fixes.
• Keep dependencies updated and run tests in CI to prevent production regressions.

Common Production Pitfalls

• Leaving required fields blank or using vague one-word answers.
• Filling the document once and never updating it after scope or decisions change.
• Storing the document where the team does not look during incidents or reviews.
• Not assigning an owner, due date, or review cadence.
• Copying boilerplate without removing sections that do not apply.
• Skipping version control, which makes rollback and accountability impossible.
• Failing to link the document to related decisions or follow-up actions.
• Avoiding quarterly reviews that would retire stale or unused sections.