For systems that aren't running in Kubernetes, what tools are you using to manage SSL/TLS certificate renewals? Are Certbot with Let's Encrypt, acme.sh, Win-acme, or a managed provider such as AWS or Cloudflare working well for you? I'm also interested in how you monitor expiration dates and verify that renewed certificates are actually being served. Blackbox Exporter seems useful, but I'd like to hear what others use, especially for catching silent renewal or service-reload failures.
4 Answers
For Windows, Certify The Web or Win-acme are common options. In cloud environments, AWS and Cloudflare can handle much of the renewal automatically. Whatever tool you choose, make certificate rotation and the service reload part of the automation, then monitor what external clients actually receive. That catches both failed renewals and successful renewals that were never deployed.
Certbot with Let’s Encrypt and a systemd timer works well for services behind Nginx. The important part is monitoring the certificate presented by the live endpoint, not just whether the renewal command returned successfully. A renewal can succeed on disk while Nginx or a load balancer continues serving the old certificate because it was never reloaded.
Use an external TLS check against the real hostname and alert on the number of days until expiry. Ideally it should also verify the issuer, SANs, SNI result, and certificate chain. Blackbox Exporter is a good fit if you already use Prometheus; otherwise, a small script using openssl or a hosted uptime monitor can do the same job.
acme.sh is a solid choice, especially when paired with Ansible for distributing certificates. We also add every certificate to our monitoring system so expiration dates are checked independently of the renewal process.
Where do you store the certificates after renewal? That seems like an important part of keeping the process secure and manageable.
Checking the full chain matters too. A leaf certificate can be valid while clients still fail because an intermediate certificate is missing or incorrect.