TLS certificates and domain renewals: the expirations that cause outages

Reference article · 5 min read

A certificate or domain expiration is one of the few outages an agency can see coming. The date is fixed the moment the item is issued, and the failure is usually total: browsers block the site with a full page warning, the remote access portal rejects every login, or the domain stops resolving and mail stops arriving. The cause is rarely technical. Certificates and domains get bought one at a time, by different people, across many budget years, and nobody assembles the full list.

Agency environments accumulate exactly the way that produces this. A payment page hosted by one vendor, a permitting portal from another, a legacy application with an internal certificate, a firewall management interface, a code signing certificate held by one developer, and a few vanity domains bought years ago. Each works until the day it does not.

What counts as an expiring asset

Most agencies inventory public web certificates and stop there. The outages come from the rest of the list.

• Public web and payment endpoints. Including redirect domains, staging sites the public can reach, and any hostname a vendor operates for you.
• Remote access and network devices. VPN concentrators, firewall and switch management interfaces, load balancers, and the RADIUS certificate wireless clients validate during 802.1X authentication.
• Identity and federation. SAML and OIDC signing certificates, identity provider metadata, and the certificates vendors hold on their side of each trust relationship.
• Internal application and service certificates. Mutual TLS between services, database connections, internal certificate authorities, and the intermediate certificates in each chain, which expire on their own schedule.
• Device management and push services. Mobile device management platforms typically depend on push certificates renewed on a recurring cycle, usually through the account that created them.
• Code and document signing. Signing keys are now generally required to live on hardware tokens or hardware security modules, making renewal a logistics task with lead time.
• Domain registrations. The .gov or .us registration, legacy names, DNSSEC key material, and the registrar lock and contact records that control all of it.

Finding the ones nobody remembers

Certificate Transparency logs are public and show certificates issued for your domains, including ones a department or vendor obtained without telling central IT. An external scan of your public address ranges catches hosts that are in no asset system. Configuration management and load balancer configs catch internal certificates. Purchasing card statements and accounts payable records catch registrations that were never ticketed. Then ask each vendor in writing which certificates and domains they hold for you, and who renews them.

Manual renewal no longer scales

The maximum lifetime for publicly trusted TLS certificates has been shortened repeatedly by the industry bodies that set browser trust rules, and further reductions have been scheduled. Confirm current limits with your certificate authority rather than what was true at your last renewal, because the direction is clearly toward shorter lifetimes.

A calendar reminder plus a person is no longer a working process. Use ACME or the equivalent automated issuance your platform supports on the public web tier, the load balancer, and anywhere else the tooling allows. Where automation is impossible, such as some appliances and vendor hosted pages, record it as a documented exception with a named owner.

Domains fail differently than certificates

A lapsed certificate breaks trust. A lapsed domain can be registered by someone else, and because domain records carry mail routing, the failure takes down email along with the website.

The .gov namespace is administered by the federal government and carries eligibility and authorization requirements for United States government organizations, along with obligations to keep contact records current. Locality namespaces under .us are obtained through commercial registrars and renew like any other paid domain. Rules and fees in both change over time, so confirm current requirements with the official registry rather than an internal document. In every case, enable auto renewal, keep the registrar lock on, and use role based contact addresses that survive staff turnover.

Owners, funding, and the calendar

Three failures produce most real incidents.

• The retiring employee's card. An item bought on an individual purchasing card renews into an account nobody else can reach. Move every renewal to an agency account with a role based email address and a shared payment method.
• The holiday weekend. Expirations do not respect closures. Check whether any expiry date falls near a holiday, a fiscal year close, or a change freeze, and move those renewals earlier.
• Unfunded renewals. A renewal nobody budgeted for stalls at the purchase request. Attach renewal cost and month to the owning program's budget line.

Give every entry a named owner and a backup, and alert both well before expiry rather than once.

What to ask vendors and put in contracts

• Which certificates and domain names do you hold or manage for us, and in whose account are they registered?
• Is issuance automated, and what happens when automation fails?
• How far ahead will you notify us of a renewal, and what is your response commitment if an expiration causes an outage?
• Require that domains the agency paid for are registered to the agency, not the vendor.
• Require transfer of all certificate and domain assets and account access at contract end or termination.

How to start

1. Build the list this month, even if incomplete, using Certificate Transparency, an external scan, and vendor responses.
2. Record owner, backup, expiry date, renewal cost, funding source, and account of record for each entry.
3. Automate every renewal the platform supports, and mark the rest as exceptions.
4. Review the list quarterly and after every staff departure.

HQT works with state and local agencies on infrastructure and application operations, including certificate and domain inventory and automated issuance.

Frequently asked questions