TLS certificates are automatically renewed before expiry

An expired TLS certificate produces browser warnings that users train themselves to click through — or it breaks service entirely, causing an outage with no security justification. Manual certificate rotation fails at scale: teams forget expiry dates, renewal windows get missed during vacations, and a 90-day Let's Encrypt cert can silently expire over a long weekend. NIST 800-53 SC-17 requires certificate management controls. CWE-295 covers improper certificate validation. Automated renewal removes human failure from a process that must succeed on a strict calendar.

Deploy cert-manager in your cluster and annotate Ingress resources for automatic renewal. Install cert-manager, then configure a ClusterIssuer and annotate your Ingress in k8s/ingress.yaml:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - example.com
      secretName: example-tls
  rules:
    - host: example.com
      # ...

cert-manager renews certificates 30 days before expiry automatically. For cloud-managed load balancers, use ACM (AWS) or managed certificates (GKE) to delegate renewal entirely to the provider.