# Certificate expired: pre-release checklist

Source: https://releasefailures.com/incidents/certificate-expired/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A TLS certificate or pinned certificate expires and connections fail.
- [ ] PR-01 List every certificate the service presents or trusts, including internal service-to-service and LDAP backend certificates, with its expiry date and renewal owner. (test class: Configuration and environment tests)
- [ ] PR-02 After each renewal, fetch the certificate from every node and region behind the domain and confirm each one serves the new serial number. (test class: Configuration and environment tests)
- [ ] PR-03 Alert when the last successful run of the scheduled certificate renewal job is older than its renewal interval. (test class: Configuration and environment tests)
- [ ] PR-04 After a renewal, confirm every dependent service presents its own renewed certificate, and restart those that still present the old one. (test class: Configuration and environment tests)
- [ ] PR-05 Probe every domain on a shared SAN certificate on a schedule and alert when fewer than 30 days remain before expiry. (test class: Synthetic monitoring)
- [ ] PR-06 Run a probe from inside the network against internal TLS endpoints and alert when fewer than 30 days remain before expiry. (test class: Synthetic monitoring)
- [ ] PR-07 Route certificate expiry alerts to a paged path that requires acknowledgment. (test class: Configuration and environment tests)
- [ ] PR-08 Send a test certificate expiry alert through the paged path each week and confirm someone acknowledges it. (test class: Synthetic monitoring)
- [ ] PR-09 Send a heartbeat alert from the monitoring platform every hour and page when the incident management system does not receive it. (test class: Synthetic monitoring)