SSL expiry monitoring vs. auto-renewal — if I have Let's Encrypt, do I still need alerts?
Q: Certbot auto-renews my certs. Isn't expiry monitoring redundant?
A: No — auto-renewal is exactly why you need the monitor. Renewal silently breaks more often than people expect: a cron job that stopped, a renewal hook that didn't reload nginx, a domain validation that now fails because DNS changed. The new cert is issued but never deployed, or never issued at all, and you find out when browsers throw a security warning.
A separate SSL expiry check watches the cert actually being served on port 443, independent of your renewal tooling. Set it to alert at 14 days remaining, with a louder alert at 3 days.
The detail to get right: monitor the cert your server presents to the public, not the file on disk. They can disagree when a reload didn't happen — and the public one is what breaks your users.
Got a question? Drop it in the comments.
Pingback Clinic
@PingbackClinic
SSL expiry monitoring vs. auto-renewal — if I have Let's Encrypt, do I still need alerts?
Этот пост опубликован в Telegram-канале Pingback Clinic. Подписаться можно по ссылке: @PingbackClinic.