Certificate expiry is the most predictable outage there is, and it still happens constantly, usually on an internal service nobody realised had a certificate at all. This tracker covers those as deliberately as the public ones.
Inventory beyond the public website. Load balancers, internal APIs, mail servers, VPN appliances, code signing, client certificates, and private CA roots all expire. The public site is the one with monitoring; the others are the ones that take you down.
Record the renewal method honestly. Distinguish fully automated from manual-with-a-reminder. Teams often believe everything is automated until a renewal fails and nobody knows the manual process.
Name an owner who is not a person on holiday. Certificates expire at inconvenient times. Owner should be a role or team with a deputy, and the alerting should reach a shared channel rather than one inbox.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
Sort by days remaining. Anything under 30 days without automated renewal needs action now.
| Common name | SANs | Type | Where installed | Issuer | Expires | Days left | Renewal method | Owner |
|---|---|---|---|---|---|---|---|---|
| www.acme.com | acme.com, www.acme.com | Public DV | CDN + origin LB | Let's Encrypt | 2026-12-28 | 75 | Automated (ACME) | Platform |
| vpn.acme.com | - | Public OV | FortiGate fw-lon-01 | DigiCert | 2026-11-12 | 29 | Manual | Infrastructure |
More free templates IT teams use alongside this one.
DNS accumulates records faster than anyone removes them, and a CNAME pointing at a decommissioned cloud resource is a subdomain takeover waiting to be found by someone else. This inventory makes stale records visible.
Network documentation fails because it is written once, as a project deliverable, and then diverges from reality within a quarter. This template is scoped to the things that change slowly and are expensive to rediscover at 02:00.
Network hardware fails quietly into unsupportability: firmware stops receiving security updates, support contracts lapse, and the vendor announced end-of-life two years ago. This inventory surfaces those dates before they become an incident.
Common name and SANs, where the certificate is installed, issuer, expiry date and days remaining, renewal method and whether it is automated, and a named owning team. Internal and private CA certificates matter as much as public ones.
Usually because the automation covers only part of the estate. Internal services, appliances, and client certificates are commonly outside ACME automation, and private CA certificates do not appear in certificate transparency logs that external monitoring relies on.
A first alert around 60 days gives room for procurement and change approval on manually renewed certificates, with escalation at about 14 days. Alerts should reach a shared channel so a single person's absence does not cause the outage.
