---
title: Certificate renewal and expiry tracking
slug: certificate-renewal-and-expiry
summary: How to find every certificate before it expires, renew the managed ones automatically and run a safe, rehearsed renewal for the ones that are not.
order: 14
updated: 2026-11-11
status: ready
---

Use this page for a weekly expiry sweep, when an expiry warning arrives, or when an outage smells like TLS. Certificate expiry is one of the most common and most preventable causes of outages.

## Know every kind of certificate you own

| Kind | Where it lives | Renews itself? |
| --- | --- | --- |
| Public TLS from a managed CA (for example ACM with DNS validation) | Load balancers, CDN | Yes, if validation records still exist |
| Imported TLS certificates | ACM imported, web servers | No |
| Private CA or mTLS client certs | Service mesh, partner integrations | Depends |
| Vendor and partner certificates (portal logins, signing certs) | Vendor portals | No, and usually a manual portal process |
| Code-signing and SAML signing certs | CI, identity provider | No |
| SSH host keys and CA | Bastions | No |

Keep an inventory with owner, expiry date, where it is installed and the renewal runbook link.

## Sweep for expiry

```bash
# ACM, per region (read-only)
aws --profile <readonly-profile> --region <region> acm list-certificates \
  --includes keyTypes=RSA_2048,EC_prime256v1,RSA_4096 \
  --query 'CertificateSummaryList[].{arn:CertificateArn,domain:DomainName,notAfter:NotAfter,renewal:RenewalEligibility,type:Type}' \
  --output table

# Any endpoint, from outside
echo | openssl s_client -connect <host>:443 -servername <host> 2>/dev/null \
  | openssl x509 -noout -subject -enddate
```

- [ ] Alert at 30 days, page at 7 days.
- [ ] AWS Health also sends ACM renewal problems; route those events to the team.

## Why managed renewals fail

- [ ] The DNS validation CNAME was deleted. Recreate it from the certificate's details.
- [ ] The certificate is not in use, so the CA does not renew it. Delete it if truly unused.
- [ ] A CAA record blocks the CA.
- [ ] It is an imported certificate. Those never auto-renew.

## Run a manual renewal safely

1. Get the new certificate (CSR from a key generated where it will live; never email private keys).
2. Check the chain and the key match before touching production.
3. Install on a non-production endpoint first, or add it alongside the old one.
4. Swap in production during a change window, through the [change process](./change-control-in-regulated-environments.md).
5. Verify from outside, then remove the old certificate after a day.

```bash
# Key and cert match? The two hashes must be equal
openssl x509 -noout -pubkey -in cert.pem | openssl sha256
openssl pkey -pubout -in key.pem | openssl sha256

# Full chain verifies?
openssl verify -CAfile chain.pem cert.pem
```

## Rollback

Keep the old certificate installed or re-importable until the new one has carried traffic for 24 hours. Rollback is re-attaching the old one, which only works while it is still valid, so renew at least two weeks early.

## Pitfalls

- Renewing the certificate but not the intermediate chain.
- Vendor portal renewals owned by someone who left. Name an owner and a backup for each.
- Pasting private keys into tickets or chats. Keys move only through a secret manager.