It’s an unfortunate reality that it can be easy for mistakes to happen with SSL renewals, especially if you’re keeping track of multiple certificates manually. This is set to worsen with SSL lifespans shortening even further over the next few years. As you’ll see below, these mistakes often stem from factors like unclear ownership, poor communication, missed verification, and lack of automation. And, for the most part, it boils down to poor management rather than anything technical.
Read on to learn more and discover the solutions.
1. Waiting until the last minute
Waiting until the last minute to do anything is generally not a wise idea, and that goes double for SSL renewals. That’s because starting the renewal process doesn’t mean you’ll instantly receive your certificate. So if you leave it until the day before, you run a high risk of not getting it on time, leaving your site or service unsecured. Some common issues that can delay SSL issuance include:
Validation delays
Though domain validation (DV) is usually fast, organization validation (OV) and extended validation (EV) can take several days as they require business verification. Other factors that can delay validation include waiting for DNS propagation, or if your Certification Authority Authorization (CAA) record is set up incorrectly or doesn’t include the correct Certificate Authority (CA).
Deployment issues
Even after you receive the SSL, installing it can reveal unexpected problems, too. Particularly if you need to install it in multiple places. Some things that could go wrong include mismatched private keys, forgetting to update an SSL on one server, or name-mismatch errors.
Unexpected problems
Sometimes an issue might not have anything to do with a mistake on your part. But if the CA has an outage or a validation ends up in the wrong inbox, that will most certainly delay things. And if you’ve only left yourself with a short time period before renewing your SSL, you’re sure to run into trouble.
How to avoid it
Don’t treat the expiration date as the deadline. Start the renewal process at least 30 days ahead of time. This will provide ample time to resolve any unexpected delays that might crop up during the renewal process.
2. Not knowing where your certificates are installed
The downside of multiple SSL certificates across different locations is that it’s easy for one or more to fall through the cracks. You may remember the core ones, such as for your business website, but others you may not notice you’ve forgotten to renew and redeploy until something breaks. Some places where this can happen include:
- Test environments – These can easily be forgotten once a site or app goes live, but a forgotten SSL can pose a problem if it’s part of a wildcard SSL or if someone returns to do more work.
- Internal tools – VPNs, dashboards, and APIs can be easily forgotten in the fray, but pose a problem to users once an expired SSL stops them from working properly.
- A legacy server – If you’re using an older server as a failover server or for redirects, forgetting about an SSL may become a problem.
How to avoid it
Get on top of certificate management and build an SSL certificate inventory.
3. Treating reminders as the whole plan
Reminders are only as good as the people responding to them. It’s all well and good to set up reminders, but if there’s nobody assigned to respond to the reminder, nothing will be done about it.
This isn’t always due to not assigning someone in the first place. Sometimes it may be that the person in charge of SSL renewals changed roles or left the company, and nobody was chosen to replace them. Other times it may be that only one person gets the reminder, with no mechanism in place to alert the team if they’re off sick or on vacation.
How to avoid it
Set up renewal reminders to go to a team inbox, shared calendar, or ticketing system so that they will never fall by the wayside. This is also something that should be periodically reviewed, so someone changing roles or moving companies won’t impact things. Setting up continuous monitoring is also a great solution.
4. Renewing the certificate but forgetting to install it
Even if you act on reminders and begin the renewal process, it means nothing if the issued certificate isn’t deployed. And the annoying thing about forgetting at the final hurdle is that there will be no more reminders from the CA, since they have already issued your new SSL.
This is more likely to happen if you have multiple certificates to update. You might install some, but forget others.
How to avoid
Check all your sites and services to see if the new SSL has been installed. One easy way to do this is in your browser. Hit the SSL certificate icon to the left of the web address in your browser (this will look different depending on what browser you use). Then view the certificate details and ensure the validity dates match the new SSL, not the old one. You should be able to find these dates in your CA confirmation email or SSL dashboard.
Automation can also help if it’s set up for deployment, which brings us nicely to the next renewal mistake.
5. Ignoring automation
As we’ve already pointed out a few times now, keeping track of multiple certificates can be tough. Adding automation into the mix can make life much easier and ensure no SSL falls through the cracks. Automation oversees the entire SSL lifecycle, from requesting and validating to installing and renewing certificates, so you can save a great deal of time on SSL management.
How to avoid
Set up SSL automation, whether that’s an ACME client, such as Certbot, or a certificate lifecycle management (CLM) platform, such as Keyfactor or CyberArk.
6. Nobody is in charge of the renewal process
We’ve talked about reminders already, but what about performing the renewal itself? When nobody is assigned to renew, then a reminder will sit unread across inboxes and corporate messaging apps, while everybody who sees it thinks that someone else will deal with it. This can happen when someone who previously configured an SSL moved on to a different team or company, and nobody was assigned to take over.
How to avoid
Link renewals to a specific job role and ensure they have the specific knowledge and permissions to deal with it. Document the process so that if the usual person is missing, another team member who also has the right authorization can take over.
7. Never test the renewal process
It’s easy to fall into the trap of assuming that just because something worked before, it will always work. But that’s a recipe for mistakes to happen, whether your renewal process is manual or automated. For manual renewals, issues may arise once someone else takes over the process. For automation, it’s easy to ignore it entirely and assume everything works perfectly. But tools can break, or other factors, like changing a server, can impact things. And you might not get an alert until the certificate expires.
How to avoid
Periodically test the process. For manuals, this means walking through every step of SSL renewal, not just reading documentation. For automation, look into certificates’ issuance and expiration dates, as well as renewal logs to ensure everything is working as it should. Schedule these checks into your calendar so you don’t forget.
Best practices for reliable renewals
Follow this quick checklist to ensure you stay on top of your SSL inventory:
- Start the renewal process 30 days before expiration
- Confirm every installed SSL location, from internal tools to site servers
- Set up multi-channel reminders, not just emails to one person
- Verify SSL certificates have been installed correctly after renewal
- Ensure a person or role is accountable for SSL renewals
- Test the renewal process periodically to ensure it still works
The takeaway
Renewal failures often boil down to issues with an established (or out-of-date) process. By following the advice in this article and ensuring every SSL certificate in your arsenal is properly tracked along with clear ownership and continual testing, you’re sure to run into fewer problems along the way. That goes for manual and automated operations alike.
Frequently asked questions
How early should certificates be renewed?
At least 30 days before expiration, as this will give you buffer time to deal with any issues that may take extra time, such as longer validation checks or DNS propagation problems.
What happens if a renewal fails?
It depends on the timing. If you have plenty of buffer time, you can simply look into what went wrong and restart the process. But if the SSL expires, your site or service may be without an SSL until you resolve the issue.
Can renewals be automated end-to-end?
Yes, but not all SSL automation tools do it out of the box. CLM platforms are designed to manage the whole process, including issuance and installation. While ACME clients can install SSL certificates, it may not do so automatically; you might need to configure it to do so yourself.
How do I know whether a new certificate is installed?
Head to your browser and check the SSL certificate button located beside the web address. Here you can see whether the live SSL has the correct validity dates.
Is monitoring still necessary if renewal is automated?
Yes. While automation brings added convenience, things can still go wrong. So periodic monitoring is essential for ensuring your SSL certificates are all up to date.
Cora is a digital copywriter for SSLs.com. Having eight years of experience in online content creation, she is a versatile writer with an interest in a wide variety of topics, ranging from technology to marketing.