Expiring SSL certs cause instant trust failures. OnCallReady detects certs within the renewal window, triggers ACME/Let's Encrypt renewal, deploys the new cert, and reloads the web server — zero downtime, zero human involvement.
Fires on SSL/TLS certificate alerts indicating upcoming or current expiration. Typical triggers: "SSL certificate expiring in 7 days for api.example.com", "Certificate expired on prod-lb-01", "TLS cert renewal required". Catches both proactive warnings and post-expiry failures.
Connects directly to the domain and checks the current cert's expiry date, issuer, and SANs. Confirms which specific domain(s) need renewal.
Invokes certbot or the configured ACME client with the appropriate challenge method (HTTP-01 or DNS-01). Handles wildcard certs via DNS challenge when configured.
Copies renewed certificate and key to the configured deployment path. Updates symlinks for zero-downtime swap. Maintains backup of prior cert for rollback.
Sends SIGHUP (graceful reload) to nginx, apache, or haproxy. Existing connections are not dropped. New connections immediately use the renewed certificate.
Performs a TLS verification check against the live domain. Confirms new cert is being served, expiry is 90 days out, and no mixed-content or chain errors exist.
OnCallReady handles SSL expiry automatically — proactively, before users see errors.