A small TLS renewal runbook
How to make certificate renewal boring and observable.
This note documents a practical approach used in Kin4 Notes. The goal is a setup that can be explained, reproduced, and checked from outside the machine.
Know the validation path
HTTP validation needs a reachable port 80, while TLS-ALPN and DNS validation use different routes. Document which method each host uses and whether a firewall or proxy can interfere. A certificate that renews only after manual changes is an incident waiting to happen.
certbot certificates
ss -lntpCheck consumers after renewal
A new file on disk does not prove that every process loaded it. Review deployment hooks, reload the web server, and inspect the certificate presented over the network. Pay attention to containers with separately mounted copies.
openssl s_client -connect example.com:443 -servername example.com </dev/nullTest before the deadline
Run the renewal command in dry-run mode and verify the timer. Alert on both renewal failure and approaching expiry. Those signals complement each other: a timer can appear healthy while the service still presents an old certificate.
certbot renew --dry-run
systemctl list-timers certbot.timer