Reading certificate expiry signals

Certificate checks are useful when they happen early enough to avoid rushed changes.

Certificate review should check expiry, covered names, renewal method, and what the public site serves.

What to watch

Expiry date for the certificate in active use.
Names covered by the certificate.
Whether renewal is automatic and recently verified.

Look at the active certificate

The certificate installed somewhere in a tool is less important than the certificate visitors actually receive. A useful check looks at the public name and records the active certificate details.

This helps catch situations where renewal succeeded in one location but the public path still serves an older certificate.

Check name coverage

Expiry is only one part of certificate health. The certificate also needs to cover the names currently in use, including common alternate names where relevant.

Name coverage should be checked after DNS changes, site moves, and any change to public routing.

Keep renewal evidence close

Automatic renewal is valuable, but it still needs evidence. A recent dry run, renewal log, or scheduled check gives the team confidence before the expiry window becomes urgent.

The note should record where renewal evidence can be found without copying sensitive material.

Certificate review list

Check the certificate served by the public name.
Record expiry date and covered names.
Confirm renewal method and last successful check.
Review whether DNS changes affected the active name.
Set a follow-up before the warning window becomes urgent.