Hello all! Curious how folks here handle TLS certificate ownership across teams? We recently had a renewal silently fail and the tricky part wasn’t expiry — it was figuring out who owned the endpoint and where else the same cert was reused. Are you just relying on cert-manager/ACME + alerts, or do you track ownership/runbooks somewhere?

Personally, combination cert-manager & certbot & caddy & tracking expiry with uptime kuma dashboard with webhooks to slack.

Nice that’s a very real-world stack Do you have a good way today to answer: “who owns this endpoint/cert?” and “where else is the same cert reused?” We found expiry monitoring was easy, but those two questions were what slowed us down during incidents.

i treat it as part of infra, so its all coalessed under infra. app teams "shouldnt" be dealing with certs. for alot of it, cert-manager issues a wildcard for that arena, so *.nonprod.app.example.com is isolated to that environment, which tracks to a github repo, with ownership descriptions (repo would be named app.example.com, and it has terraform noting all the clusters. slightly different for some metal hosts, because i'm lazy, and dont want to move that to k8s, and fight with getting things to work nicely (its mail servers)

That’s a pretty clean setup. Do you ever run into issues when the same wildcard or cert ends up reused across clusters or metal hosts and something changes (issuer/chain/etc)? We found that the infra repo told us intent, but during incidents we still had to manually confirm where the cert was actually deployed.

not really, each deployment using cert-manager is quite explicit

apiVersion: <http://cert-manager.io/v1|cert-manager.io/v1>
          kind: Certificate
          metadata:
            name: "default-ingress-cert"
            namespace: company-core-cert-manager
            annotations:
              <http://argocd.argoproj.io/sync-wave|argocd.argoproj.io/sync-wave>: "1"
          spec:
            dnsNames:
            - "*.<http://apps.nonprod.app.example.com|apps.nonprod.app.example.com>"
            - "*.<http://nonprod.app.example.com|nonprod.app.example.com>"
            - "*.<http://platform.nonprod.app.example.com|platform.nonprod.app.example.com>"
            - "*.<http://internal.nonprod.app.example.com|internal.nonprod.app.example.com>"
            - "*.<http://public.nonprod.app.example.com|public.nonprod.app.example.com>"