TLS Certificate Lifecycle Management
Certificate management at enterprise scale is a significant operational and security challenge. A single expired certificate can cause outages, while a compromised CA can undermine all encrypted communications.
Certificate Lifecycle
1. Request and Issuance
- Certificate Signing Request (CSR) generation
- CA validation (DV, OV, EV)
- Certificate issuance and delivery
- Key pair security (HSM storage for high-value certs)
2. Deployment
- Installation on servers and load balancers
- Configuration of cipher suites and protocol versions
- OCSP stapling configuration
- Certificate pinning decisions
3. Monitoring
- Expiration date tracking (alert at 30, 14, 7 days)
- Certificate Transparency (CT) log monitoring
- Unauthorized certificate detection
- Revocation status monitoring
4. Renewal and Rotation
- Automated renewal via ACME (Let's Encrypt, ZeroSSL)
- Key rotation during renewal
- Staged rollout to prevent outages
- Validation of new certificate before cutover
5. Revocation
- CRL (Certificate Revocation List) publication
- OCSP responder updates
- Emergency revocation procedures
- Post-revocation verification
Automation with ACME
# Automated certificate management
certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com --deploy-hook "systemctl reload nginx"
Common Issues
- Expired certificates: Cause service outages and browser warnings
- Weak keys: RSA < 2048 bits or outdated algorithms
- Mixed content: HTTPS pages loading HTTP resources
- Incorrect chain: Missing intermediate certificates
- CT log exposure: Certificates revealing internal hostnames
Where SuperClue Fits
SuperClue's DAST scanner checks the TLS certificate and protocol settings of each site you scan and flags certificates close to expiry. Its domain reconnaissance module also searches certificate transparency logs (crt.sh) for certificates issued for your domain. It does not manage a full certificate inventory.