Certificate Lifecycle Service  ·  View 05 of 21  ·  People and journeys

Journey — The Expiry That Did Not Happen

The SRE's journey through a failure that, in most designs, nobody experiences until it is an outage.

Editable source SVG draw.io All views
Platform SRE on call for the estate Goal — Find out about a broken renewal while it is still boring Trigger — A renewal attempt fails 30 days before expiry and nothing breaks yet Done when — The new serial is observed serving, and nobody outside the team ever knew 1 · Renewal due T-30 d 2 · It fails silently 3 · They find out ◆ moment of truth 4 · They fix it in hours 5 · Verified ◆ moment of truth What they do Nothing Nothing Reads the named reason Fixes the delegation Re-runs the order Closes the alert Where Expiry dashboard Ticket at T-30 Order detail page Probe result How it feels Calm Alert Alarmed Behind the glass Renewal scheduler Jittered retry Attempt ledger Escalation ladder Owner lookup Order manager Delivery adapter Endpoint prober Divergence check Where it hurts A failed job is not an alert No owner on the record Issued but not reloaded Probe cannot reach it What answers it Renew at 1/3 life Incident at first failure Owner required to manage Reload is part of renewal Unprobeable is a gap User Journey — The Expiry That Did Not Happen The trough is at 'they find out', which is the only phase the architecture can move. Every design choice in this set exists to make it arrive at T-30 rather than at T-0. v 1.0 · owner Reliability Architecture · date 2026-09

Where it actually fails

  • Phase 2 is the dangerous one: the renewal has failed and the sentiment line is still calm, because a failed job is not an alert in most certificate tooling.
  • The architecture cannot remove the failure. It can only move the moment of discovery, and every choice in this set exists to move it from T-0 to T-30.

The mechanism

  • Renewal at one third of life remaining, so the window between first failure and expiry is 30 days on a public certificate and 8 hours on a workload leaf.
  • A failed renewal is an open incident from the first failed attempt, escalating at 30 / 21 / 14 / 7 days against remaining validity rather than against job status.
  • The last phase is verification by probe, because the fix is not complete when the certificate is issued.

Assumption

  • Any managed certificate reaching 7 days remaining is treated as a page-worthy defect whether or not anything has broken. The threshold is invented and arguable.
◀  Journey — A Tenant Brings Their Own Domain All views Layered Architecture  ▶
Solution Architecture v1.0 · Amazon Web Services · Security Platform Architecture · 2026-09 · 21 views · 20 architecture decision records05-journey-expiry-that-didnt-happen