Pārbaudīt sertifikātus pirms to termiņa beigām

Kad izmantot

Every week, for every domain and hostname the company serves over HTTPS. Not when a site is already down or throwing certificate errors in a browser — that is an incident, use tech.website-down. Not for the domain name itself expiring — that is tech.renew-domain, which this check must not overlap with (a valid certificate on a lapsed domain is still a red row).

Pirms sāc

• The domain list is current: every domain in the registrar list appears here, including defensive and
• The hostname map exists: for each domain, which names are expected to answer with a certificate
• It is known which certificates are automatic (ACME/Let's Encrypt) and which were bought and must be

Ceļš7 soļi

1. S1

   Collect the targetsaģents

   Read the domain list and the hostname map; resolve each hostname to confirm it still points at our infrastructure.

   Izdarīts, kad the run has a list of hostnames to check, each marked expected / unexpected.

2. S2

   Read each certificate from the outsideaģents

   For every hostname, fetch the certificate a visitor actually receives: issuer, notBefore, notAfter, subject and SANs.

   Izdarīts, kad every hostname has an expiry date and days remaining in the table.

   ⛔ Never read the expiry from the renewal system's own records — read what the server serves.

3. S3

   Verify the certificate fits the name and the chainaģents

   Check the hostname is covered by the SANs, the chain validates from outside (no missing intermediate), and the certificate is not self-signed or for a neighbouring name.

   Izdarīts, kad each hostname is marked fit / misnamed / broken chain.

4. S4

   Verify renewal is actually happeningaģents

   For automatic certificates, compare notBefore with today: a Let's Encrypt certificate renewed within the last ~90 days means the job works; an old notBefore with a far expiry means it was bought once and nothing renews it. For bought certificates, confirm the renewal date is in the watch (ops.contract-renewal-watch or the domain list).

   Izdarīts, kad each certificate is marked auto-renewing / manual / orphaned.

5. S5

   Check the endpoints behind the certificateaģents

   Open each HTTPS endpoint; confirm it answers, redirects http→https where expected, and the certificate the browser sees matches S2.

   Izdarīts, kad each hostname is marked serving / stale cert / not answering.

   ⛔ A certificate renewed on disk but not reloaded is the classic false pass — S5 catches it.

6. S6

   Flag and open tasksaģents

   Every red row (under 30 days, misnamed, broken chain, orphaned, not answering) gets a task in the tasks module with the hostname, the finding, and a deadline before the expiry date.

   Izdarīts, kad every red row has a task id next to it.

7. S7

   Reportaģents

   Send the owner the weekly summary: how many hostnames checked, how many red, the earliest expiry, and the task ids opened.

   Izdarīts, kad the report is sent and the dated table is stored as evidence.

Pārbaudes — kā zinām, ka izdevās

• Every hostname on the map appears in the table — a missing row is a miss, not a pass.
• Every certificate has 30 days or more remaining, or has a task with a deadline before expiry.
• Every automatic certificate shows a recent notBefore — renewal proven, not assumed.
• Every hostname answers with the same certificate S2 recorded (ask the server, not the renewal tool).

Ja noiet greizi

Ko atstāj katrs solis

1. S1the run has a list of hostnames to check, each marked expected / unexpected.
2. S2every hostname has an expiry date and days remaining in the table.
3. S3each hostname is marked fit / misnamed / broken chain.
4. S4each certificate is marked auto-renewing / manual / orphaned.
5. S5each hostname is marked serving / stale cert / not answering.
6. S6every red row has a task id next to it.
7. S7the report is sent and the dated table is stored as evidence.

Ko saglabāt

The dated expiry table for the run · task ids opened and their deadlines · the weekly report as sent · for any red row, the raw certificate details (issuer, SANs, notAfter) captured at check time.

Kā šī procedūra uzlabojas

After every 10 runs ask: how many red rows, and did any certificate reach under 30 days twice — meaning the fix did not hold? Were there false alarms (a red row that was fine)? Did any hostname on the map disappear, or any serving hostname stay off the map? Did any certificate expire with no warning despite this check running? A new version changes the step that missed it, and says so in its change note.