SSL Certificate Renewal Playbook
Certificate problems often become urgent only after users see warnings. A lightweight renewal playbook helps catch expiry, domain mismatch, DNS drift, and deployment timing before they cause downtime.
Track the certificate window
Check the expiry date, issuer, and covered hostnames. Treat short remaining validity as a deployment task, not a last-minute incident.
Verify every public hostname
Root domains, www hosts, app subdomains, API hosts, and regional aliases may use different certificates or deployments. Check each hostname users can visit.
Confirm DNS and hosting alignment
A certificate can fail if DNS points to an old provider or if a new host is not attached to the deployment. Confirm A, CNAME, and platform domain settings together.
Test after renewal
After renewal, check the live certificate from an external network. Browser caches, CDN edges, and old deployments can make local checks misleading.
Keep an incident note
Document who owns renewal, where DNS is managed, what platform serves the site, and which hostnames are covered. This saves time during future changes.
Related tools
SSL Checker helps inspect certificate expiry and hostname coverage. Use URL Checker for URL and redirect checks.