How to use this checklist
Run this review before a service is allowed to depend on automated issuance for a name that users reach. It is not a review of whether a certificate can be obtained; that part is usually working by the time anyone asks for a review. It is a review of the three stages that follow issuance and fail silently: the reload, the alert on failure, and the detection of automation that has stopped running at all.
Re-run it whenever the shape of the automation changes, and whenever the authority changes something you depend on. Profiles, default lifetimes and issuance limits are all moving targets on published schedules, so a readiness review that predates the last change to any of them is describing a system that no longer exists. Treat a review older than the current certificate lifetime as expired.
Where the numbers come from
The lifetime and the renewal window are read from the certificate in front of you and from the response the authority gives for that certificate, never from a remembered default. The served serial comes from a connection made from outside the host, and the file serial from the path the service configuration names. Issuance headroom is the count of names the automation manages compared against the published limit for the registered domain, including any other account in the organisation that issues for the same domain.
Four items are attested rather than measured. Probing the challenge path from a second network needs a vantage point no command on the renewal host can reach. Rehearsing the manual path produces a person who has done it, not an output. The validity behaviour of the order and the reuse decision are statements about intent that a running system cannot confirm on your behalf.
Access this needs
Read access to the client configuration and renewal directories on one representative host, permission to run the client in its dry-run mode, an outside network position that can open port 443 and port 80 to the service, read access to the DNS zone or its records, and read access to the alerting configuration and the timer definitions. No item requires a private key to be read, copied or moved off the host, and no item requires a real issuance against the production authority.
What the review produces
A dated record naming the reviewer, the names in scope, the client and its version, the challenge type in use per name, the measured issuance headroom, and the serial comparison for each service. Findings go to the team that owns the service, not to the team that owns the automation, because the failure that matters lands on the service. The record is the evidence a later incident review reads when it asks how long the gap had been open.
Sign-off
- Reviewer: ________________ Date: ___________
- Platform owner: ___________ Date: ___________
- Security owner: ___________ Date: ___________
Every critical item must pass. A failing critical item blocks the service from being declared safe to depend on automated renewal; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.