Operational notes for certificate owners

Notes on certificate monitoring and renewal, with links to the technical sources.

Practical guide · acme.sh + Nginx

acme.sh renewed the certificate, but Nginx still serves the old one

Check acme.sh installation paths and reloadcmd, then compare the served TLS certificate. Includes a tested local demonstration with Nginx. Read note Practical guide · cert-manager

cert-manager: Certificate is Ready, but the Ingress serves the wrong certificate

Compare the certificate in a Kubernetes Secret with the one served by your Ingress. Diagnose a Ready Certificate with a tested cert-manager demonstration. Read note Practical guide · Traefik

Traefik serves the wrong certificate: check SNI, routers and ACME

Diagnose a default or unexpected TLS certificate in Traefik. Check SNI, the ACME resolver and file certificates, with a tested local demonstration. Read note Practical guide · Certbot + Nginx

Certbot renewed the certificate, but Nginx still serves the old one

Compare the certificate on disk with the certificate served over TLS, reload Nginx and verify the result. Includes a reproducible local demonstration. Read note Automation · July 2026

ACME automation is not certificate monitoring

ACME and ARI automate issuance and renewal. This note covers the inventory, ownership, and alerts needed to check the deployed result. Read note Post-quantum · July 2026

Preparing TLS for post-quantum cryptography: what to inventory

What PQC changes in TLS, which standards apply, and what to inventory before planning a migration. Read note Inventory · July 2026

Certificate Transparency is not a certificate inventory

CT logs are useful for public certificate discovery and unexpected issuance, but they do not show every deployed endpoint, owner, or renewal path. Read note TLS operations · July 2026

TLS certificate lifetimes: 200, 100, then 47 days

A concise operational note on the CA/Browser Forum schedule and what infrastructure teams should inventory before renewal windows shrink again. Read note