Keeping TLS certificates boring

TLS certificates should be quiet infrastructure. They only become interesting when renewal fails.

Check DNS first

Before issuing a certificate, confirm the domain points to the expected host:

dig example.com A

If DNS is wrong, the ACME challenge will usually fail.

Verify from the outside

openssl s_client -connect example.com:443 -servername example.com

I check the subject, issuer, and expiration date after every certificate change.

Remember reloads

Renewal is not enough. The process serving TLS also needs to load the renewed certificate files.