Automate a weekly domain and SSL expiry watch

A domain registration and a TLS certificate each have an end date, and they are tracked in different places. The registrar emails someone who may have left. An automatic certificate renewal works until a DNS change or a moved server breaks it. Both failures look the same to your customers: the site is unreachable or shows a security warning. The two dates also rarely match: a certificate can end months before or after the registration. A site served from a different host than its domain name may present a certificate issued for that host, so the host that answers is the one that matters.

You list your domains. Each week the scheduled agent looks up the public RDAP record for each one, where the expiration event gives the registration end date, and, where the site answers over HTTPS, reads the notAfter date of the certificate it presents. RDAP is the standard registration lookup protocol, and not every registry publishes an expiration date, so the agent marks those as unknown rather than guessing. If a domain redirects to another host, the agent names the host it checked. It sorts everything by days left and puts items inside your warning window at the top. It reads public data and changes nothing.

Before the list reaches you, the department head agent checks it: does each date come from the record it cites, are unknown dates labelled as unknown, and does a domain that redirects elsewhere get checked at the right host. Then you approve, edit or skip it, and nothing is delivered until you do.

Renew anything inside the window and switch on auto-renew at the registrar where it is off. For a certificate that is near its end despite auto-renew, check the renewal job before the date, not after. Add subdomains that serve customers, since each has its own certificate.