Domain and certificate renewals are easy to overlook because nothing looks broken until they are overdue. By then, visitors may be unable to reach the site or may see a browser security warning.
The answer is a small, repeatable process: know what you own, know when it expires, and make sure the right person gets the warning.
Build one inventory
List every production domain and important subdomain. For each domain, record its registrar, account owner, renewal setting, payment owner, expiry date, name servers, and the service it supports. For each certificate, record where it is installed, how it is renewed, and who can fix a failed renewal.
Do not assume the person who manages the website also controls the registrar. Agencies, clients, IT teams, and former employees often hold different pieces of access.
Alert early enough to act
One reminder the day before expiry is not a renewal process. Use several reminders spaced far enough apart to resolve an expired card, account-access issue, or failed automatic renewal. Send them to a role or shared team channel where possible, rather than only to one person’s inbox.
The exact schedule depends on your organization, but a useful starting point is to review domain and certificate expirations monthly and give high-value domains extra lead time. Confirm the renewal actually completed; do not close the task merely because someone clicked “renew.”
Check more than the date
A certificate can be present but still fail validation because it covers the wrong hostname, the chain is incomplete, or the server serves an old certificate. Test the public endpoint that visitors use, including important subdomains. For domains, verify the name servers and registration data as well as the expiry date.
When registration details are available through RDAP or a registrar, treat them as a useful source of truth while recognizing that providers may display dates and ownership fields differently. Keep access to the registrar account as part of the runbook.
Prepare for changes of ownership
Before an employee or agency relationship ends, transfer registrar and certificate-renewal access to a current owner. Check that recovery email addresses, two-factor authentication, and billing details are up to date. A domain set to auto-renew can still fail if its payment method or account access is stale.
Review after every renewal
Once renewed, confirm the new expiration date appears in the monitoring view and that the site serves a valid certificate. If a renewal required manual intervention, document what failed and whether it can be automated safely next time.
Bryzora’s domain and SSL monitoring brings expiry dates and alerts together. Start with your most important domain, then work through the full inventory before the next renewal season.