Certificate Expiry & Rotation War Room
Certificates do not fail on cryptography — they fail on calendars. Work a fleet of certs one week at a time with limited renewal capacity, and rotate each one against its real deadline — the expiry date minus the CA's lead time, not the expiry itself. A slow EV cert expiring in three weeks can already be overdue. Prevent every outage, start the slow renewals early, keep a slot free for the cert that surfaces mid-exercise with two days left, and do not waste capacity renewing what still has runway.
The real job. More noise, a tighter clock.
Work the rotation queue
You own a fleet of 15 certificates. Each week you can START only 3 renewals. A renewal is not instant — the lead time is how long the CA takes, so the day you must act by is the expiry minus the lead, not the expiry itself. Miss that deadline and the cert lapses — an outage. Renew far too early and you burn a scarce slot that an at-risk cert needed.
Every date is measured from a fixed snapshot of 14 Oct 2026. Watch for a slow EV cert whose real deadline is weeks before it looks due, and a shadow cert that surfaces mid-exercise with almost no life left. Score on outages prevented minus wasted early renewals; finish under par for a speed bonus.
What this lab is
- A free, browser-based certificate lab: work a rotation queue week by week across a fleet of certs, choosing which to renew now under a limited weekly renewal capacity.
- The lesson is the deadline, not the expiry: a renewal takes a lead time, so you must start by (expiry − lead). A slow EV cert expiring in three weeks can already be overdue today.
- A cert that lapses before its renewal completes is an outage; renewing something with weeks of runway wastes a scarce slot an at-risk cert needed.
- Surprises mirror real life: a shadow cert surfaces mid-exercise with ~2 days left, and a slow-CA cert must be started early or it can never be saved.
- You are scored on outages prevented minus wasted early renewals; harder tiers mean a bigger fleet, tighter capacity and more surprises.
Frequently asked questions
What is the Certificate Expiry & Rotation War Room?
A free, in-browser exercise where you manage a fleet of simulated TLS/PKI certificates over a series of weekly ticks. Each week you can start only a limited number of renewals. Because a renewal has a lead time (the CA process is not instant), the day you must act by is the expiry date minus that lead time. You decide which certs to renew now while new expiries approach, and you are scored on how many outages you prevent versus how much capacity you waste renewing certs too early.
Why does renewal lead time matter so much?
A certificate does not renew the instant you click — a domain-validated ACME cert might reissue in a day, but an EV cert needs around two weeks of CA vetting. So a payment-gateway EV cert that expires in three weeks has a real deadline less than one week away. Reading the expiry date instead of the deadline (expiry minus lead) is the single most common way real fleets suffer a surprise outage.
What counts as an outage and a wasted renewal?
An outage is any cert that reaches its expiry without a completed renewal — in production that is a down service, a broken integration or a locked-out workforce. A wasted early renewal is starting a rotation more than a tick before it was needed: it still prevents a lapse, but it spends one of your scarce weekly slots that an at-risk cert required. Good rotation hygiene means acting inside each cert renewal window, not before and not after.
Is this a real certificate manager?
No. It is a teaching simulation with invented hostnames, issuers and dates measured from a fixed snapshot. It deliberately simplifies CA mechanics so the one lesson — rotate against the deadline, keep capacity in reserve for surprises, and start slow-CA certs early — is clear. No account, no install, nothing leaves your browser.