SSL That Renews Itself (And What Breaks When It Doesn't)
A practical look at automated certificate issuance — the ACME challenge types, why renewal fails quietly, and the monitoring that catches it before your visitors do.
Platform Engineering
Infrastructure & reliability
Free certificates solved the cost of HTTPS. They did not solve the operations of HTTPS — and a certificate that renews automatically 89 times and fails on the 90th is worse than one you had a calendar reminder for.
The two challenges, and when to use which
| Challenge | Proves you control | Needs | Wildcards |
|---|---|---|---|
| HTTP-01 | The web server on port 80 | Port 80 reachable publicly | No |
| DNS-01 | The DNS zone | API credentials for the DNS provider | Yes |
HTTP-01 is the default because it needs nothing but a reachable server. We use DNS-01 for our own wildcard domain, so every newly provisioned site can serve HTTPS the instant it exists — before the customer has pointed anything at us.
Why renewal fails quietly
Renewal runs unattended, which means every failure mode is silent by construction. In order of how often we've actually seen them:
- A redirect swallowed the challenge. A blanket
http → httpsredirect that catches/.well-known/acme-challenge/too. Exempt that path, always. - Rate limits. Retrying a broken config in a loop burns the weekly certificate budget for the whole domain, and then even a correct request fails.
- The renewal timer stopped. The unit was masked during an unrelated incident and nobody unmasked it. Certificates expired 60 days later.
- DNS moved. The customer changed nameservers; HTTP-01 kept working, DNS-01 silently stopped.
# What is actually installed, and when does it die?echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -subject -issuer -dates # Prove renewal works without spending a rate-limit slotcertbot renew --dry-runMonitor expiry, not renewal
It's tempting to alert when the renewal job fails. Don't — alert on what the visitor sees. Check the certificate the server is actually presenting, and page someone when it has fewer than 21 days left. That catches the job failing, the job succeeding but not reloading the server, and the file being copied to the wrong path.
Monitor the outcome, not the process. Processes have a hundred ways to succeed at the wrong thing.
