How to use this checklist
This checklist covers one endpoint. Run it before that endpoint takes production traffic, and again whenever the certificate, the key, the terminating software or the set of names it answers for changes. Ten services need ten runs, because the interesting failures are per-service: the missing intermediate on one node, the alias nobody put in the subject alternative name, the reload hook that was copied from a service with a different unit name.
Do the wire readings first and the file readings second. The wire is the only observation point shared with a customer, and every file reading in this list exists to explain a difference between the file and the wire. A review conducted entirely on the host will approve an endpoint that has been serving a stale certificate from memory since its last restart.
Where the numbers come from
The chain, the served serial, the fingerprint and the negotiated protocol come from a connection made across the network a client would use. The validity window, the extensions and the purpose come from the certificate file, read with the same tool that produced the wire capture so the two can be compared without conversion. Permissions and clock state come from the terminating host itself.
Four items are attested rather than measured. Whether the key ever left its host, who owns renewal, whether the monitoring probe travels the customer path, and whether the default virtual host behaviour is deliberate are all statements somebody makes. The commands here can show what is true now; only a person can say whether it is intended. Record the name against each of those four.
Access this needs
A client host on the customer network path with OpenSSL 3.x, able to reach the endpoint without traversing the same proxy the monitor uses. Read access to the certificate file and to the service configuration that names it. Enough access on the terminating host to read the mode and ownership of the key file, though never its contents. Read access to the monitoring definition. The reload rehearsal needs a change window and somebody with the authority to restart the service.
What the review produces
A dated record naming the reviewer, the endpoint, and the serial and fingerprint read from the wire at the time of review. Attach the captured chain, the hostname and purpose verification results, the protocol reading, and the before-and-after fingerprints from the reload rehearsal. Findings go to the service owner; anything about key file permissions or key transport goes to the security owner the same day. Add the endpoint to the certificate inventory before closing the record.
Sign-off
- Reviewer: ________________ Date: ___________
- Service owner: ____________ Date: ___________
- Security owner: ___________ Date: ___________
Every critical item must pass. A failing critical item blocks the endpoint from taking production traffic; it is not a launch-day caveat. Record the date, the reviewer, and the disposition of every item that did not pass, including which of the failures were accepted and by whom.