📅 Certificate Renewal Schedule¶
🔔 Warning System¶
┌─────────────────────────────────────────────────┐
│ Días antes │ Acción │
├────────────┼────────────────────────────────────┤
│ 90 │ Email reminder: Iniciar renovación │
│ 60 │ Calendar alert + email │
│ 30 │ URGENT: Bloquea release si no done │
│ 7 │ EMERGENCY: All hands │
└─────────────────────────────────────────────────┘
📋 Certificate Inventory Template¶
| Cert Type | Platform | Expires | Responsible | Status | Notes |
|---|---|---|---|---|---|
| Windows EV | Windows | 2025-12-31 | DevOps Lead | ✅ Active | DigiCert |
| Apple Dev ID | macOS | 2025-06-15 | iOS Lead | ⚠️ 45d | Renew soon |
| GPG Signing | Linux | 2026-01-01 | Release Mgr | ✅ Active | Public key: ABC123 |
Status Legend¶
- ✅ Active - Certificate valid, no action needed
- ⚠️ Warning - Expires in < 90 days, renewal in progress
- 🔴 Urgent - Expires in < 30 days, immediate action required
- 🔄 Renewing - Renewal process started
- 📦 Ordered - New certificate ordered, awaiting delivery
- 🧪 Testing - New certificate imported, testing in progress
- ⏸️ Deprecated - Old certificate, keep for reference
🔄 Renewal Process¶
Phase 1: Preparation (90 days before expiration)¶
┌─────────────────────────────────────────────────────┐
│ Week 1-2: Planning & Ordering │
├─────────────────────────────────────────────────────┤
│ □ Review current certificate details │
│ □ Check budget approval │
│ □ Order renewal from vendor │
│ □ Verify company information is current │
│ □ Schedule validation calls if needed (EV certs) │
│ □ Create calendar reminders for team │
└─────────────────────────────────────────────────────┘
Phase 2: Validation (60-75 days before)¶
┌─────────────────────────────────────────────────────┐
│ Week 3-4: Vendor Validation │
├─────────────────────────────────────────────────────┤
│ □ Respond to vendor validation emails │
│ □ Provide required documentation │
│ □ Complete phone validation (EV certs) │
│ □ Verify hardware token delivery (if applicable) │
│ □ Track validation status daily │
└─────────────────────────────────────────────────────┘
Phase 3: Import & Test (45-60 days before)¶
┌─────────────────────────────────────────────────────┐
│ Week 5-6: Import & Testing │
├─────────────────────────────────────────────────────┤
│ □ Download new certificate from vendor │
│ □ Import to test environment │
│ □ Sign test builds │
│ □ Verify signature validation │
│ □ Test on all target platforms │
│ □ Document any issues │
│ □ Create rollback plan │
└─────────────────────────────────────────────────────┘
Phase 4: Production Deployment (30-45 days before)¶
┌─────────────────────────────────────────────────────┐
│ Week 7-8: Production Rollout │
├─────────────────────────────────────────────────────┤
│ □ Backup old certificate securely │
│ □ Update CI/CD configuration │
│ □ Import to production signing servers │
│ □ Sign staging release for validation │
│ □ Deploy to production │
│ □ Verify signatures on distributed builds │
│ □ Monitor for issues │
│ □ Update documentation │
└─────────────────────────────────────────────────────┘
Phase 5: Archival (After successful deployment)¶
┌─────────────────────────────────────────────────────┐
│ Post-Deployment: Cleanup │
├─────────────────────────────────────────────────────┤
│ □ Archive old certificate securely │
│ □ Update inventory spreadsheet │
│ □ Document lessons learned │
│ □ Set reminders for next renewal │
│ □ Verify old certificate still validates old builds │
│ □ Keep old cert for 1 year minimum │
└─────────────────────────────────────────────────────┘
🚨 Emergency Renewal (< 30 days)¶
Fast-Track Process¶
- Day 1: Order & Escalate
- Order from vendor immediately
- Request expedited processing
- Pay rush fees if available
-
Contact account manager directly
-
Day 2-3: Validation Sprint
- Prioritize validation responses
- Have team on standby for calls
-
Prepare all documents in advance
-
Day 4-5: Import & Test
- Parallel testing with multiple team members
- Automated test suite for signature validation
-
Skip nice-to-have testing, focus on critical paths
-
Day 6-7: Deploy
- Emergency change request
- Deploy outside normal release window if needed
- All-hands monitoring for first 24h
📊 Tracking Dashboard¶
Key Metrics to Monitor¶
┌──────────────────────────────────────────────────┐
│ Metric │ Target │ Current │
├───────────────────────────────┼────────┼─────────┤
│ Avg renewal lead time │ 60d │ 52d │
│ Renewals completed on time │ 100% │ 95% │
│ Emergency renewals │ 0 │ 1 │
│ Expired certificates │ 0 │ 0 │
│ Cost per certificate │ Budget │ $X │
└──────────────────────────────────────────────────┘
🔔 Automated Monitoring¶
Script for Checking Expiration¶
# Add to scheduled task (daily)
.\certificate_store_setup.ps1 -Action List |
Select-String "⚠️" |
Send-Mail -To "team@company.com" -Subject "Certificates expiring soon"
Calendar Integration¶
- Import to team calendar
- Set recurring reminders
- Include responsible person in event
- Add pre-meeting alerts (1 week, 1 day, 1 hour)
📝 Renewal Checklist Template¶
Certificate Renewal Ticket Template¶
# Certificate Renewal: [Cert Type] - [Platform]
## Details
- **Certificate:** [Type and name]
- **Current Expiration:** [Date]
- **Responsible:** [Person]
- **Vendor:** [Vendor name]
- **Cost:** [Amount]
## Checklist
- [ ] Budget approved
- [ ] Certificate ordered (Date: ___)
- [ ] Validation completed (Date: ___)
- [ ] Certificate received (Date: ___)
- [ ] Imported to test environment (Date: ___)
- [ ] Test signing successful (Date: ___)
- [ ] Signatures verified (Date: ___)
- [ ] CI/CD updated (Date: ___)
- [ ] Deployed to production (Date: ___)
- [ ] Old certificate archived (Date: ___)
- [ ] Inventory updated (Date: ___)
- [ ] Next renewal reminder set (Date: ___)
## Notes
[Add any special considerations or issues encountered]
## Verification
- [ ] Test build signed: [Link to build]
- [ ] Signature validates on: Windows / macOS / Linux
- [ ] SmartScreen/Gatekeeper status: [OK/Pending]
📧 Email Templates¶
90-Day Reminder¶
Subject: Certificate Renewal Required - [Cert Name] expires in 90 days
Team,
The [Certificate Type] certificate for [Platform] will expire on [Date].
Action Required:
1. Order renewal from [Vendor]
2. Schedule validation if needed
3. Update tracking spreadsheet
Responsible: [Person]
Budget: [Amount] - Approval needed by [Date]
Calendar invite sent for renewal kickoff meeting.
30-Day Warning¶
Subject: URGENT - Certificate Renewal - [Cert Name] expires in 30 days
Team,
URGENT: The [Certificate Type] certificate expires in 30 days on [Date].
Current Status: [Status from tracking]
If renewal is not complete, we will BLOCK releases starting [Date - 7 days].
Please update the tracking spreadsheet immediately with current status.
Escalation to [Manager] if not completed by [Date - 14 days].
🗄️ Archive Policy¶
What to Keep¶
- Old certificates (1 year after expiration)
- Renewal documentation
- Validation records
- Purchase receipts
- Configuration backups
Where to Store¶
- Secure vault (1Password, Azure Key Vault)
- Encrypted backup drive
- Secure file server
- Document management system
Access Control¶
- Limit access to 2-3 people
- Audit log of access
- Require MFA for access
- Review access quarterly
📈 Continuous Improvement¶
Post-Renewal Review Questions¶
- What went well?
- What could be improved?
- Were timelines realistic?
- Did we have the right people involved?
- Were tools and processes adequate?
- What documentation needs updating?
Update This Schedule¶
- Review quarterly
- After each renewal (lessons learned)
- When vendors or processes change
- When team members change
- After any incidents or issues