It becomes especially tricky when any given customer can hard code an SSL cert into the Websphere or Tomcat server without the service provider knowing anything

It becomes especially tricky when any given customer can hard code an SSL cert into the Websphere or Tomcat server without the service provider knowing anything about it. Then, when the service provider needs to rotate the certificate because it's about to expire and is renewed or perhaps it's suddenly rotated (because of Heartbleed, for example), it breaks the customer. What kind of communication channels have you guys seen or used for that kind of scenario? A separate Twitter feed? A blog? Sending an email to all customer every time the SSL certificate changes in any way?