TLS Certificate Rotation and HSTS Scope

Working case

The permit portal serves the main app, uploads, and an older equipment dashboard on separate subdomains. A team renews only the main app certificate, then enables a long HSTS policy with subdomain coverage. The old dashboard has an incomplete TLS setup and becomes inaccessible to browsers that learned the policy. During a regional failover, the backup endpoint also presents a certificate missing the API name. The corrected rollout inventories every hostname, fixes HTTPS everywhere in scope, deploys renewed certificates to primary and fallback, starts with a short policy duration, and extends it only after browser and device tests pass.

Implementation boundary

function certificateNeedsAction(daysUntilExpiry, renewalLeadDays) {
  return daysUntilExpiry <= renewalLeadDays;
}
console.log(certificateNeedsAction(29, 47));
// Output: true

Automate issuance and renewal with a monitored owner, but still test deployment and served chain on every public endpoint. Use hostname coverage that matches real routing, including alternate and backup destinations. Protect private keys and rotate them according to the organization’s policy; a certificate file in a repository is not a deployment plan. Alert early enough to recover from renewal and propagation failures, not only on the expiry day. Enable HTTPS redirects without creating redirect loops behind a proxy. Start HSTS with a conservative duration, confirm all relevant subdomains are HTTPS-capable, then increase scope and duration. Preload is a separate long-lived commitment with additional requirements and removal delay. Check user-visible pages, APIs, media, redirects, and error responses for consistent secure behavior.

Cost and boundaries

A certificate handshake and chain add connection work, while connection reuse and session resumption can reduce repeat setup cost. Renewal automation lowers routine labor but introduces dependency on issuance, DNS or HTTP validation, and deployment pipelines. Broad HSTS coverage reduces downgrade exposure yet raises recovery cost if a forgotten host cannot serve HTTPS. Track days until earliest certificate expiry, renewal attempt failures, handshake errors by hostname and region, redirect loops, and the count of hosts outside the planned HTTPS scope. A ten-minute synthetic check can find an expired backup certificate that normal traffic rarely touches.

Failure trace

Expire the backup region certificate while the primary remains healthy, then fail over and catch the TLS error before routing traffic. Serve a chain missing an intermediate and test more than one browser or operating system trust store. Enable include-subdomains before a legacy upload host supports HTTPS and verify the affected browser cannot simply ignore its learned policy. Remove a hostname from a new certificate while its old DNS answer remains cached. Force a renewal job to succeed but its deployment step to fail; the monitor must inspect the certificate actually served, not just the issued file.

Verification

Primary and fallback hosts serve valid names and chains.
Renewal monitoring inspects served certificates, not only issued files.
HSTS scope covers only HTTPS-ready hosts.

Practice drill

Inventory app, API, upload, and fallback hosts for a permit portal. Give the earliest certificate 47 days to expiry and a backup certificate 29 days. Run renewal and deployment checks, validate served names and chains from two regions, then simulate a primary outage. Start a short HTTPS-only policy and list the subdomains that must pass before expanding its scope. Test one redirect through the proxy and one direct secure connection. Record who can roll back routing and which browser policy cannot be undone immediately for clients that learned it.

Decision note

Certificate rotation is complete only when every reachable endpoint serves a valid name and chain; HSTS scope follows tested host coverage.

Common Mistakes

Testing TLS only on the primary region.
Enabling broad HSTS before inventorying subdomains.
Treating issuance success as proof of deployment.

Apply and check

Build Project: permit domain cutover and transport recovery and review Web Development: network transport operations quiz.

Further connections

Host Authority Routing and Default Deny.