Certificate renewals
Let’s Encrypt lifetimes make calendar reminders a poor control. Renew in software.
Lead time
Start 30 days before expiry. Retry with backoff. Alert on certificate.renewal_failed instead of discovering HTTPS errors from customers.