A certificate is a lifecycle, not a file

A working HTTPS endpoint depends on more than a certificate with a future expiry date. The hostname must match, the server must send a complete chain, and the process handling connections must actually load the renewed files.

Separate the four stages

Issuance proves control of a name. Renewal repeats that proof before expiry. Deployment puts the new certificate and private key in the service's configured locations. Reloading makes the running service use them. Treating these as separate stages makes failures much easier to locate.

For a small Linux service, an ACME client and a renewal timer are usually sufficient. Keep the challenge method predictable. HTTP validation needs an accessible challenge path on port 80. DNS validation needs permission to create a specific TXT record. Neither method requires giving a certificate client unrestricted access to every domain in an account.

Check the service, not just the disk

A certificate file can be fresh while the service still presents the old one. After a renewal, inspect the certificate through an actual TLS connection using the intended server name. Check the chain, the expiry date, and the negotiated application protocol.

openssl s_client -connect example.com:443   -servername example.com -alpn h2 -verify_return_error

The server name matters when multiple sites share an address. A test against a bare IP without SNI may reach a default virtual host and tell you little about the intended website.

Keep the private key private

The certificate is public; its private key is not. Give the service only the file access it needs. Keep credentials outside the web document root, and avoid placing keys in command output, shared screenshots, or application logs.

Make renewal observable

Test the renewal path against the certificate authority's staging environment. Record whether the timer ran, whether the challenge succeeded, and whether the deploy hook completed. An external expiry check catches mistakes that a local timer cannot see.

Certificates are easiest to maintain when issuance is boring, deployment is explicit, and verification follows the same path as a real visitor.