I've recently taken responsibility for SSL/TLS certificate management at work. We have applications that send expiry notifications, but those alerts are only useful when the listed contacts and system owners are still correct.
To address that, I started sending a quarterly review. Currently, I use a spreadsheet containing certificate details, filter it by each owner, and ask them to confirm the information or provide corrections. The recipients are employees or contractors responsible for the related systems, and I use BCC when sending the review.
I've received feedback that distributing a spreadsheet containing details for many certificates is not ideal from a security and privacy perspective. I agree, but I'm unsure how to send each person only the records relevant to them without manually creating individual messages every quarter.
How do other organizations keep certificate owners and notification contacts current? The two certificate-management applications we use do not provide a built-in workflow for reviewing and confirming ownership, so I'm currently relying on a manual spreadsheet process.
I'm also planning for shorter certificate lifetimes and more frequent domain-control validation in the future, although certificates are currently provisioned manually by another internal team.
3 Answers
First determine whether these are publicly trusted certificates or certificates issued by an internal CA. Public certificates need urgent attention because certificate lifetimes are being reduced significantly, eventually reaching 47 days, which makes quarterly manual confirmation impractical. For internal certificates, the timeline may not apply in the same way, but automation is still worthwhile.
Also, notify a team or shared mailing list instead of relying on one individual. Ownership changes, migrations, and replacement certificates can otherwise leave people receiving stale expiry alerts. Monitoring should verify that the currently deployed certificate is the one being tracked and should flag duplicates or certificates that were replaced months earlier.
For the ownership review itself, avoid sending a complete certificate spreadsheet to everyone. Use an access-controlled form, portal, or workflow that shows each person only the certificates assigned to them and lets them confirm or update the owner, service, environment, and notification group. If you only have spreadsheets available, generate one limited report per owner automatically and send it through an approved internal process rather than distributing the master file.
The long-term answer is automation. For certificates that support it, use ACMEv2 to issue and renew them automatically, with monitoring that alerts the responsible team if issuance or renewal fails. Ideally, TLS termination is centralized at load balancers, reverse proxies, or service meshes, so individual application owners do not need to manage certificates directly.
That’s the direction we want to take, but certificates are still provisioned manually by another internal team, so we have a fair amount of groundwork to do first.