The Certonomy field guide
Certificate management.
From first inventory to verified renewal.
Practical SSL and TLS guides for the MSPs and IT teams keeping firewalls, Windows servers, and web services online. Start with the process, or go straight to the platform you manage.
Start here · 5 min readMSP certificate management without the renewal ticket queue
A practical MSP certificate management playbook: inventory client certificates, assign ownership, automate deployment, and measure renewal success.
Read the MSP playbookOperations
7 guides· 5 min read
MSP certificate management without the renewal ticket queue
A practical MSP certificate management playbook: inventory client certificates, assign ownership, automate deployment, and measure renewal success.
· 4 min read
SSL certificate monitoring that catches more than expiry
Monitor TLS certificate expiry, hostname coverage, trust chains, and failed renewals. Build actionable alerts for VPNs, web servers, and client fleets.
· 4 min read
Build a certificate inventory you can actually renew from
A TLS certificate inventory checklist with a copyable CSV template. Track service owners, bindings, DNS access, renewal methods, and live verification.
· 4 min read
Certificate renewed but the site still shows expired? Follow the TLS path
Troubleshoot a renewed SSL certificate that is not live: separate validation, issuance, installation, binding, reload, and endpoint verification failures.
· 5 min read
Certificate renewal automation: how to stop expiry outages
What certificate renewal automation has to include so a new certificate actually reaches the firewall, Windows server, or web tier before it expires.
· 4 min read
Automatic certificate deployment across firewalls and web servers
How automatic certificate deployment installs a renewed TLS certificate on FortiGate, Palo Alto, SonicWall, IIS, and the web servers in front of them.
· 4 min read
Certificate lifecycle management vs spreadsheet renewals
Certificate lifecycle management compared with spreadsheet renewals: inventory, expiry monitoring, renewal, and the install on the device.
Platforms
4 guides· 4 min read
FortiGate certificate renewal: check the listener, not just the certificate list
Plan FortiGate certificate renewal with native ACME checks, certificate references, live endpoint verification, and a recovery checklist for IT teams.
· 4 min read
IIS certificate renewal: a new certificate still needs the right HTTPS binding
Renew IIS TLS certificates with a checklist for private keys, Windows certificate stores, HTTPS bindings, SNI, server farms, and live verification.
· 4 min read
NGINX certificate renewal: files, graceful reloads, and live checks
A practical NGINX TLS renewal checklist: certificate paths, full chains, configuration tests, graceful reloads, containers, and endpoint verification.
· 5 min read
Device certificate auto-renew checklist
A checklist for auto-renewing device certificates on FortiGate, IIS, Palo Alto, SonicWall, and the other platforms Certonomy installs on at launch.
TLS & ACME
2 guides· 4 min read
ACME DNS validation: automate the challenge without exposing the service
Understand ACME DNS-01 validation, CNAME delegation, wildcard certificates, DNS credentials, and why domain validation must still run at renewal.
· 4 min read
TLS certificate lifetimes: 200 days, then 100, then 47
Public TLS certificates are capped near 200 days now, 100 days from March 2027, and 47 days from March 2029. What IT teams should change.