Certificate expiry monitoring beyond IIS
Overview
TLS certs hide in LDAPS, LDAPS over AD CS, RADIUS, SQL, VPN appliances, Wi-Fi WPA-Enterprise, and IoT. IIS-only monitors miss them.
Inventory
Spreadsheet: FQDN or CN, issuer, location (store vs file), renewal owner, private key escrow status.
Tools
ACME where supported; commercial expiry scanners for internal hosts; Powershell pull from *cert:* remoting.
Alerts
30/14/7 day stagger; weekend on-call gets push, not inbox-only.
Renewal testing
Staged deploy first; validate chain includes modern intermediates—Android clients stricter than your IE11 memory.
Incidents
If expired mid-business: temporary public cert only if architecture allows; document emergency rollback time.
Compliance
Some frameworks require SHA-256 minimum and key size policy—track in same DB.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...