Direct answer
Certificate inventory connects each endpoint to its certificate, owner and renewal path. An expiration date in a console is useful, but the certificate actually served to clients also needs verification.
List endpoints and owners
Inventory public and internal hostnames, load balancers, certificates, issuers and responsible teams. Include alternate regions and disaster recovery endpoints. Avoid copying private keys; they are not needed to inspect a served certificate.
Reference: OWASP Transport Layer Security Cheat Sheet.
Check served certificates
From an authorized client, inspect the certificate presented for the hostname and verify the intended name, chain and expiration with supported tooling. Compare it with the deployment inventory and note differences caused by DNS or edge locations.
- Review renewal ownership and alert recipients.
- Record deployment and certificate expiration dates.
- Check whether internal services use a separate trust chain.
Exercise renewal safely
In a test environment, renew or replace a certificate through the supported process and verify deployment to the intended endpoint. Check dependencies on DNS validation, service accounts and secret distribution without exposing the private key.
Monitor and retest
After production renewal through the normal change process, inspect the served certificate again from representative locations and confirm clients connect. Assign owners to failed alerts, stale inventory and untested disaster recovery endpoints.
Assessment limits
A certificate's validity does not prove the application is trustworthy or the TLS configuration is otherwise secure. Inventory and tests may miss dormant or separately managed endpoints.
Frequently asked questions
Does a valid certificate mean a website is safe?
No. It supports an authenticated encrypted connection to a hostname; the site's content and application security need separate assessment.
Why check the certificate actually served?
A renewed certificate may exist in a management console without being deployed to every endpoint or edge.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.