What is your experience in setting up cyclic…

I use a combination of tools for certificate monitoring. The main monitoring of the status and expiration date of certificates on web servers and services is implemented through:

Prometheus Exporters:
- ssl exporter: Collects metrics about certificate expiration dates from specified endpoints.
- node exporter (in conjunction with text files): Can be used to monitor certificate files on the filesystem.
Bash or Python scripts regularly check the certificate status (for example, using openssl x509 -in cert.pem -noout -enddate) and record the result in a format understandable by node exporter (textfile collector).
Alertmanager:
- I configure rules in Alertmanager to trigger notifications (for example, 30, 7, and 1 day before expiration) based on metrics from Prometheus.
- Notifications are sent to Slack, email, or other communication channels.

Automatic certificate renewal is usually implemented using ACME clients such as certbot or lego.

Task scheduling: Cron jobs or system timers (systemd timers) run the ACME client to check and renew certificates.

# Example cron entry for certbot
0 */12 * * * root certbot renew --quiet --standalone --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"

Automation via CI/CD: For more complex scenarios or environments using Kubernetes, the certificate renewal process can be integrated into the CI/CD pipeline.

For example, when using Kubernetes Ingress objects with TLS, a certificate manager like cert-manager automates the issuance and renewal of Let's Encrypt certificates using a Controller and Custom Resource Definitions (CRD).

# Example Ingress with annotations for cert-manager
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - example.com
    secretName: example-com-tls
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-service
            port:
              number: 80

Updating configurations: After successful certificate renewal, scripts or pipelines reload or re-read service configurations (web servers, load balancers) to start using the new certificate.

The combination of monitoring and automation minimizes the risk of service failure due to expired certificates.

What is your experience in setting up cyclic certificate status monitoring and its automatic replacement in DevOps?