Let’s Encrypt’s 11 March 2026 Certbot guidance described the practical steps around short-lived and IP-address certificates. At that point, the documented IP-address workflow supported issuance but still required attention to installation and service reloads. The distinction is a useful reminder that obtaining a certificate and putting it into use are separate operations.
Follow the certificate all the way through
Our proposed acceptance test starts with the endpoint a user reaches. The renewal process must obtain the certificate, write it to the correct location, make it available to the service and activate it. A deployment with several nodes also needs a way to establish that each relevant endpoint has changed.
A failure at any of those handovers can leave the renewal system reporting success while a service approaches expiry. The control should therefore compare the intended state with what is actually served, rather than relying entirely on the exit status of an issuance command.
Design the alert around action
An expiry alert is useful when it reaches someone with time, access and a procedure to resolve the problem. That requires an explicit owner. It also requires a threshold that reflects the certificate’s lifetime and the organisation’s ability to respond outside normal working hours.
We would include the renewal service’s credentials and dependencies in the recovery review. If access has expired, a secret has been rotated or a node cannot retrieve the new material, the responder needs a route back to a working process. Repeated retries alone may leave the underlying fault untouched.
Use a small, observable rollout
Before changing a large fleet, select a representative service and observe a complete renewal cycle. Verify the deployed certificate externally, check each termination point and deliberately exercise the escalation route in a controlled test.
Record the evidence in terms that another operator can use: where the certificate is issued, where it is activated, how live state is checked and who responds. That record is more valuable than a screenshot of a successful job.
The March guidance is historical context; tooling continues to change. The durable requirement is an observable chain from issuance to the live connection, with responsibility assigned at every step.