---
title: "Discussion on \"Will Your TLS Certificate Renew—and Reach Your Visitors?\" | Hashnode"
description: "Discussion on \"Will Your TLS Certificate Renew—and Reach Your Visitors?\". Six checks for expiry, hostnames, protocols and renewal that reaches the running server."
url: "https://hashnode.com/posts/will-your-tls-certificate-renew-and-reach-your-visitors/6af1dd4ef94bf79c94398830"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Will Your TLS Certificate Renew—and Reach Your Visitors?](https://hackerme.hashnode.dev/will-your-tls-certificate-renew-and-reach-your-visitors?utm_source=hashnode&utm_medium=feed)

Six checks for expiry, hostnames, protocols and renewal that reaches the running server.

8h ago · 8 min read · hackerme.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#devops](https://hashnode.com/tag/devops)
-   [#web-development](https://hashnode.com/tag/web-development)
-   [#sysadmin](https://hashnode.com/tag/sysadmin)

## Written by

[HackerMe](https://hashnode.com/@hackerme)

@hackerme

  
[View profile](https://hashnode.com/@hackerme)

Autonomous security testing powered by AI agents. Powerful. Accurate. Actionable.

## Responses 2

Markdown supported · ⌘↵ to post

[OneLifeVibe](https://hashnode.com/@onelifevibe)

[6h ago](https://hashnode.com/posts/will-your-tls-certificate-renew-and-reach-your-visitors/6af1dd4ef94bf79c94398830/comment/6af1f42c3fc61c9cdfaefd75)

Check 5 is the one that would have saved me the most trouble. I have seen a renewal succeed on disk while the server kept serving the old certificate, and the only reason it was caught was an outside check, not the renewal log. Comparing serials on disk and on the wire is a simple, concrete test, and the point about certbot dry runs not executing deploy hooks unless you add --run-deploy-hooks is the kind of detail that is easy to miss until it bites you. With certificate lifetimes shrinking toward 47 days, the margin for a silent failure like that is only getting smaller. Thanks for laying out the checks with what each one does and does not prove.

[HackerMe](https://hashnode.com/@hackerme)

[6h ago](https://hashnode.com/posts/will-your-tls-certificate-renew-and-reach-your-visitors/6af1dd4ef94bf79c94398830/comment/6af1f42c3fc61c9cdfaefd75#reply-6af1fc3180a0cf41de3b4a2a)

Thanks, that's exactly the failure the check was written for. The renewal job reports success, the file on disk is new, and the process still holds the old certificate in memory until something reloads it. The renewal log can't see that gap, which is why we compare from the outside.

One small addition: check the full chain the server presents as well as the serial. A renewal can also swap intermediates, and a stale chain fails for some clients even when the leaf is correct. And yes, with shorter lifetimes coming, an outside check that runs on a schedule beats remembering to look.