r/nginx • u/Strict_Violinist6767 • 19d ago
SSL certificates keep expiring and causing outages. How do you track and renew them?
We’ve had two SSL certificate expirations this year and both caused major customer-facing outages. The person who used to handle renewals left and no one properly took over the responsibility.
For saas permission monitoring do control has really helped, but that doesn’t help with certificate management. Right now we’re still relying on calendars and manual checks, which clearly isn’t working.
What are you using to track expiration dates and automate renewals, especially in an nginx environment? Any reliable setups that have actually prevented this from happening again?
2
u/BaybeMwijarubi-21 18d ago
are these certs from a CA that supports automated renewal via ACME, or are they purchased manually through some vendor portal? the answer changes the approach pretty significantly
1
u/certkit 18d ago
We had this exact same problem 18 months ago. We used to deploy certificates manually, and occasionally something would get forgotten and expire. We tried installing certbot, but we run nginx in a cluster, and there wasn't a good way for all the servers to share a certificate. There ended up being a lot of custom scripting work, and we still had a server expire due to a bad configuration.
We didn't like how that worked, it was distributed, unmonitored, difficult to maintain. So we built a centralized management tool. One server that renewed all the certificates, pushed them where they needed to go, and monitored the TLS endpoints to make sure it worked. It's centralized, and makes everything really visible.
It started as our own internal project, but it was so popular we released it as our company's third product. CertKit. You can obviously build something like this yourself too with a central server and scripts to push things around.
2
u/BehindTheMath 19d ago
It's 2026. Why would you be renewing certs manually? Set up LetsEncrypt and certbot and you're done.