Manual SSL renewal is one of the most common causes of preventable outages — it’s easy to forget a date that only comes around once a year (or once every 90 days for Let’s Encrypt).
Automating it
- Let’s Encrypt certificates are designed to be renewed via a scheduled task (e.g. Certbot’s built-in renewal timer), typically attempted daily and only actually renewing when within ~30 days of expiry
- Confirm your web server automatically reloads (not just renews) the certificate after renewal — a renewed-but-not-reloaded certificate still leaves the old one active until a restart
- Add an independent, external SSL-expiry monitor as a safety net in case the automated renewal job itself fails silently
FAQ
Can automation fail even once it’s set up?
Yes — DNS changes, firewall changes, or a full disk can all silently break renewal; that’s why an independent expiry monitor matters even with automation in place.