HTTPS in production

Certificate lifetimes are falling because short-lived certificates limit the damage of a leaked key, reduce reliance on revocation, and force automation that removes human error. A ninety-day certificate renews six times a year; a 47-day certificate renews roughly eight times, which is only practical if no human is involved.

1. 1

   Detect

   A scheduler or agent notices the certificate is inside its renewal window.

2. 2

   Obtain

   ACME (or an internal CA API) issues a new certificate using a challenge.

3. 3

   Write

   The new certificate and key are written to the location the service reads.

4. 4

   Reload

   The service is told to reload. This is the step that most often fails silently.

5. 5

   Verify

   An external probe checks the served certificate serial and expiry, not just the local file.

6. 6

   Alert

   Failure at any step raises an alert before expiry, with enough lead time to fix it.

HTTP Strict Transport Security tells browsers to refuse plain HTTP for a domain for a period of time. It defends against downgrade and cookie-theft attacks, and it is unforgiving if you enable it too early.

• Start with a short max-age and no includeSubDomains
• Confirm every subdomain, including forgotten ones, serves valid HTTPS first
• Only then raise max-age and add includeSubDomains
• Keep the preload decision separate: preloading is effectively permanent

Monitor from the position a real client occupies: outside the network, using the same hostname the application uses, and more than one toolchain. A single 'it works in the browser' check hides most failures.