We take a belt-and-suspenders approach, mainly because I have a huge fear of the embarrassment of letting a cert (or domain name) expire. We built a DB to trac

We take a belt-and-suspenders approach, mainly because I have a huge fear of the embarrassment of letting a cert (or domain name) expire. We built a DB to track them; nothing special, it sends email reminders. Been meaning to just publish calendar reminders, but haven't gotten to it. We also check expiry dates on the live certificates via one of our monitoring systems (Zabbix, but this isn't a built-in check) that will start yelling, I think, 2 weeks before expiry.