Home/Notes/What a plant nursery needs to know about TLS certificates
What a plant nursery needs to know about TLS certificates
6 Dec 2025
How a plant nursery deals with TLS certificates — and what usually goes wrong.
The problem: an SPF record overwritten during a DNS edit. The certificate chain breaks for a plant nursery.
When we onboard a plant nursery, the first thing we check is TLS certificates. It tells us more about the previous provider than any sales call.
We underestimated how long TLS certificates migration would take for a plant nursery. The estimate was two hours; the reality was a full day because an SPF record overwritten during a DNS edit had never been documented.
a plant nursery did not want to hear about TLS certificates. They wanted to know: will the site work tomorrow morning. The answer was yes, but only if we fix an SPF record overwritten during a DNS edit today.
Two-factor on the registrar account is the single highest-value thing we do for a plant nursery when managing TLS certificates. Everything else can be rebuilt; a stolen domain cannot.
We document TLS certificates in a shared spreadsheet. It is not glamorous, but a plant nursery can open it on their phone at midnight if something breaks.
TLS certificates for a plant nursery is nothing like TLS certificates for a multinational. The scale is tiny but the stakes are the same: one wrong record and nobody can reach you.
DNS propagation is not instant, but it is not magic either. We explained to a plant nursery that the TTL on the old TLS certificates record was 86 400 seconds — twenty-four hours.
Related notes
Tell us what you need.
Write a few lines about your project. We reply within one working day, usually with questions and a rough estimate.
hello@digitalserved.com