A production outage was caused by an expired internal certificate. Nobody was tracking it. Design the fix.

What the interviewer is testing

Whether you fix the class of problem rather than the instance, and whether you know where the untracked certificates hide.

Why manual tracking fails

The interval is long enough that the person who set the reminder has changed roles. Certificate lifetimes have shortened substantially and continue to, which makes manual renewal untenable rather than merely unwise. And it is entirely predictable — the failure date is known years in advance and it still happens, repeatedly, at sophisticated organisations.

The fix

Automated issuance and renewal through ACME or an internal certificate authority, renewing well before expiry, with automated deployment — a renewed certificate sitting unbound in a store is not renewed in any useful sense.

An inventory discovered by scanning, not by asking. The certificates that cause incidents are precisely the ones nobody registered. Scan the estate's endpoints, internal and external, and reconcile against the known list.

Expiry monitoring with escalating alerts at 30, 14 and 7 days, routed to an owner, treating an alert at 7 days as an incident.

Short lifetimes deliberately. Counter-intuitively, shorter certificates are safer: they force the automation to be exercised constantly, so a broken renewal is discovered in days rather than at the next annual expiry.

Where the untracked ones live

Internal service-to-service certificates. Client certificates for partner integrations. Certificates embedded in mobile applications for pinning. Code signing certificates. Certificate authority certificates themselves, whose expiry is catastrophic and whose lifetime is long enough that nobody present remembers it. And the one configured manually on a load balancer four years ago by someone who has left.

What a strong answer adds

Flagging certificate pinning in mobile clients as a related design decision worth revisiting: it trades a narrow security gain for a serious operational hazard, since a pinned certificate that rotates unexpectedly bricks every installed application until users update.

And including certificate expiry in the standard service scorecard, so it is a continuous property rather than a periodic campaign.

Common weak answers

A calendar reminder. A spreadsheet inventory maintained manually.