Your hosting dashboard says the certificate renewed. Is the website actually serving the new certificate? Check the complete path before customers discover a browser warning.
For a UAE business taking bookings or enquiries online, certificate renewal is an operational responsibility with several moving parts. ITZ’s website maintenance service can help review renewal ownership, deployment checks and failure alerts. The aim is a working process, rather than a calendar reminder that one person might miss.
Why review the process now?
In its 7 October 2026 announcement, Let’s Encrypt confirmed default 64-day certificates from 10 February 2027 and staging availability from 14 October 2026. Existing valid certificates are not being revoked for this transition. These dates concern Let’s Encrypt; check your own issuer and hosting provider before assuming the same schedule applies.
Let’s Encrypt recommends an ACME client supporting Renewal Information, or renewal timing based on the certificate’s lifetime rather than a fixed old interval. It also calls out deployment, service reloads and renewal-failure alerts. A shorter renewal cycle makes an unnoticed break in any of those steps more consequential.
Find every place HTTPS terminates
Start with an inventory: the public website, www hostname, booking subdomain, API and any customer portal. Record the system serving each certificate, its owner and its renewal method. A CDN may serve one certificate to visitors while a separate origin server uses another. Checking the browser-facing certificate alone cannot establish the state of the origin connection.
Do not confuse domain registration, hosting renewal and certificate renewal. Paying one invoice is not evidence that all three are handled. Ask the provider what it manages, which failure notifications it sends and who receives them. Keep account ownership within the business rather than tied only to a departing employee.
Test validation without damaging production
ACME renewals must demonstrate control of the relevant names. Let’s Encrypt’s challenge documentation explains that HTTP-01 uses a specific HTTP path and port 80, while DNS-01 uses DNS TXT records and can support wildcard certificates. Your hosting arrangement determines which method is appropriate.
A firewall change, DNS-provider migration or stale DNS automation credential can interrupt a previously working renewal. For DNS automation, use narrowly scoped credentials where the provider supports them. Never place broad DNS account credentials in a public repository. Staging certificates are for testing and must not be installed as trusted production certificates.
Request a Certificate Renewal Review to discuss the hostnames, providers and handover responsibilities involved. Do not include private keys or DNS credentials in the enquiry.
Verify renewal, installation and service separately
- Confirm the renewal job runs and that failures reach a monitored owner.
- Check the newly issued certificate covers the intended hostnames.
- Confirm deployment reaches every relevant server or managed endpoint.
- Check whether the serving process needs a reload and whether that action succeeded.
- Inspect the certificate presented externally for each hostname and test a normal page or booking journey.
As an illustrative failure, a renewal job can create a fresh certificate file while the reverse proxy continues serving an old one. Another possibility is that only one node receives the update. An external check helps catch these differences; a local file’s expiry date does not.
Make alerts actionable
Use monitoring that checks the served certificate and routes failures to a primary and backup owner. Choose warning windows suited to the actual certificate lifetime and recovery procedure. Let’s Encrypt lists certificate-monitoring options; evaluate their coverage and account-access requirements for your environment.
Record what to do when renewal fails: inspect the error, identify the validation or deployment stage, involve the responsible provider and verify recovery externally. Avoid repeated manual issuance attempts without understanding the fault. A useful incident note identifies the failed stage and the preventive change, rather than simply saying “SSL fixed”.
Keep the wider website check in view
A valid certificate protects the connection; it does not prove that the site is malware-free, the enquiry form delivers or the application is secure. Follow the website security and maintenance guide for wider checks. If hosting is changing, use the website-move checklist and discuss domain and hosting responsibilities separately.
Request a Certificate Renewal Review. Use the form below to discuss certificate ownership, automation, deployment verification and failure notification across your website endpoints.
Request a Certificate Renewal Review ↗
Official Let’s Encrypt references reviewed on 15 October 2026. Issuer schedules and managed-hosting implementations vary; verify the configuration actually serving your site.
