A really easy way to avoid this in any environment with Continuous Integration style tests running on everyone's work: Add a test that just unconditionally fai

A really easy way to avoid this in any environment with Continuous Integration style tests running on everyone's work: Add a test that just unconditionally fails on a certain date, like a week before your cert expires. Don't let any code review sign off on a merge of a fix the test until the new cert is in prod. Don't let any code promote between environments while tests are broken. The problem with emails and warnings is they're all ignorable and therefore completely unsuitable for managing something as critical as a cert. The secret is to create a straight-up error that absolutely interrupts every engineer in the organization's day until the cert is renewed. A development-halting error a week before cert expiration is a hell of a lot better than a business-halting error when it expires in prod.