Security playbook · AI Employee: Sig

Certificate Expiration Tracking

Zero expired certs in prod

Install this playbookBack to marketplace
The problem

Certificates expire silently until they don't. TLS cert on the customer-facing API, mTLS certs between services, code-signing cert for the mobile app, SSL cert for the vendor callback URL — every one has an expiry date, and every one becomes an outage the moment it passes. Someone manually maintains a spreadsheet; the spreadsheet drifts; the on-call engineer discovers the expired cert during the Sunday-night outage.

At a glance
Trigger
Cron (daily)
Approvals
Owner ack on manual renew
What it does
Writes to your systems
Systems
Cert manager · Vault · DNS
How it feels in production

An hour-by-hour walkthrough.

Every night, Sig discovers every certificate the company owns. Scan sources: - Cert transparency logs (every public-facing hostname of the company + subsidiaries) - Cloud provider inventories (AWS ACM, GCP Certificate Manager, Azure Key Vault) - Load balancer configurations (nginx, HAProxy, F5) - Container / Kubernetes ingress certs - Service-mesh mTLS certs (Istio, Linkerd, Consul) - Code-signing certs (Apple Developer, Windows Authenticode, Android) - Client certs for vendor mTLS integrations For each certificate, Sig records: hostname, issuer, expiry date, owning team, deployment location, renewal mechanism (auto-renew via cert-manager, manual, vendor-issued). 60 days before expiry, Sig opens a renewal task for the owning team: - Auto-renew certs (Let's Encrypt via cert-manager, ACM): verify the renewal automation is healthy; nudge if it's not - Manual-renew certs: draft the renewal steps + coordinate with the vendor + track completion - Code-signing certs: coordinate with mobile / desktop teams for the multi-week renewal process Escalates at 30 days (owner nudge), 14 days (manager cc), 7 days (security lead), 3 days (critical alert). No cert expires without visibility. Weekly digest to security lead: upcoming renewals, at-risk certs, auto-renew health.
How it works

Step by step.

  1. 01

    Discover certificates from every source

    Cert transparency (public), cloud cert managers, load balancer configs, ingress, service mesh, code-signing, client mTLS. Normalize to unified cert records with hostname + issuer + expiry.

    Cert transparency · AWS ACM · GCP · Azure · nginx · Kubernetes · Istio
  2. 02

    Assign owner + renewal mechanism per cert

    Owner from Context Graph (service → team). Renewal mechanism from deployment (cert-manager annotations, ACM auto-renew, manual with vendor). Certs without clear owner escalate to security ops.

    Context Graph · CODEOWNERS · Cert-manager annotations
  3. 03

    Track renewal cadence + open tasks 60 days out

    Auto-renew: verify automation is healthy (last renewal on schedule, DNS validation passing). Manual: open task with runbook. Code-signing: coordinate with mobile / desktop team on longer cadence.

    Task queue · Runbook library
  4. 04

    Nudge + escalate on approach to expiry

    60d owner task, 30d owner nudge, 14d manager cc, 7d security lead, 3d critical alert. Fresh escalation each threshold; no silent expiry.

    Slack · Teams · PagerDuty · Escalation ladder
  5. 05

    Verify post-renewal + digest

    Post-renewal: verify new cert is served on the hostname, expiry date updated in registry, old cert deprecated. Weekly digest with upcoming renewals + auto-renew health + at-risk items.

    TLS probe · Cert registry · Slack digest
Systems and wiring

What you connect to make this run.

Cert transparency · Certificate Search

read

Public source of every TLS cert issued for the company's hostnames. Catches shadow certs — someone provisioning outside the standard process. Comprehensive discovery.

AWS ACM · GCP Certificate Manager · Azure Key Vault

read+write

Cloud-managed certs. Auto-renew status, DNS validation health, deployment attachment. Write: trigger manual renewal for auto-renew failures.

cert-manager · Vault PKI · Step CA

read+write

Internal PKI + Kubernetes ingress cert-manager. Read renewal history + health. Write: force reissue for at-risk certs.

Apple Developer · Windows Authenticode · Android

read+write

Code-signing cert lifecycle — usually multi-week renewal with EV validation. Coordinate with mobile / desktop teams; cert expiry breaks all releases.

What changes

Before and after, honestly.

Certificate-related outages per year
Before
3-15
After
Zero
% of certs discovered (vs. shadow)
Before
60-80%
After
99%+
Time from cert issue to registry entry
Before
7-45 days (or never)
After
Under 24 hours (nightly scan)
Auto-renew health monitoring coverage
Before
40-70%
After
100%
Related

Playbooks that pair with this one.

Security

Secret & API Key Rotation

Same rotation-lifecycle pattern for secrets + API keys.

Security

SOC2 / Vanta Evidence Collection

Cert expiry management is a common SOC 2 control; evidence flows from this scan.

Security

Incident Response Orchestration

Cert expiry incidents route through the incident-response pipeline.

Frequently asked

Answers about this playbook.

What about internal-only certs (not internet-facing)?

Internal PKI (Vault, Step, ADCS) scanned for internal certs. Cert transparency doesn't cover them; direct scan of the internal CAs picks them up. Same lifecycle management.

How does it handle pinned certs (mobile apps, embedded systems)?

Pinned cert rotation requires coordinated app update. Sig detects pinning in mobile app releases + adds a longer coordination timeline (must ship app update before cert rotation). Special handling.

What if we use short-lived certs (Let's Encrypt 90 days)?

Short-lived certs must have working automation. Sig monitors renewal health continuously; any missed renewal alerts within hours, not days. Automation health more important than expiry warning for these.

How does it coordinate with the cert authority for revocation?

Revocation happens outside this playbook (compromised key, no-longer-needed). Sig tracks revoked certs in the registry so they don't trigger renewal reminders + updates any deployments still serving them.

What about wildcard certs vs. per-hostname certs?

Both tracked. Wildcards have larger blast radius on expiry (many hostnames affected); Sig applies higher priority to wildcard renewals and clearer coordination with DNS + WAF teams.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks