Home/Notes/TLS certificates: a field note from a garage
TLS certificates: a field note from a garage
17 Jul 2024
How a garage deals with TLS certificates — and what usually goes wrong.
The problem: an SPF record overwritten during a DNS edit. The certificate chain breaks for a garage.
We underestimated how long TLS certificates migration would take for a garage. The estimate was two hours; the reality was a full day because an SPF record overwritten during a DNS edit had never been documented.
Launch day for a garage is usually light. Week three is when leftover tags, fonts, and staging URLs show up. an SPF record overwritten during a DNS edit is the usual passenger.
If you only touch TLS certificates once a year, a dashboard is extra risk. Files, a mailbox you read, and a person who still answers will outlast any SaaS control panel.
The vendor portal had silently rotated the key for TLS certificates, but a garage was still using the old one. Every outbound message bounced quietly.
Every technical decision for a garage comes back to one question: does this help the person looking at the site right now? If TLS certificates is invisible to that person, it is working.
The registrar dashboard crashed twice while we were fixing TLS certificates for a garage. We filed a ticket; they replied four days later with a template answer.
WordPress can handle TLS certificates with a plugin. But the plugin adds JavaScript, a dashboard, and a support ticket when it conflicts with the next update. We wrote four lines of config instead.
Related notes
Tell us what you need.
Write a few lines about your project. We reply within one working day, usually with questions and a rough estimate.
hello@digitalserved.com