SSL and certificates

Certificates used to be a yearly purchase and a manual install. Today most sites use free, automated certificates that renew every few months without anyone touching them, and the work has shifted to making sure automation keeps running and that certificates you still manage by hand don't expire unnoticed.

Let's Encrypt and ZeroSSL issue free certificates through the ACME protocol. Clients such as Certbot and acme.sh request and renew them on servers, cert-manager does the same inside Kubernetes clusters, and web servers such as Caddy handle the whole process themselves. Commercial authorities such as DigiCert and Sectigo sell certificates with organization or extended validation, support contracts, and tools for managing large numbers of certificates across a company.

For hosts, the practical questions are about scale and failure. How many certificates will you issue for one registered domain, and do you stay within the rate limits of the authority? Which validation method works for each site: HTTP for ordinary sites, DNS for wildcards and servers that aren't reachable from the internet? What happens when a renewal fails, and who hears about it?

Monitoring is the piece most often missing. Automatic renewal works until a firewall change blocks validation or a DNS provider's API token expires, and then the certificate runs out weeks later. Add expiry checks to whatever monitoring you already run, and alert well before the date. Keep an inventory of every certificate you run, including those on load balancers, mail servers and appliances.