ACME HQDemo work items and pages, made up for Emargen's demo. Not a real company.

Engineering / ENG-1652

Check every public TLS certificate daily; renewal failures page on-call

Project: Engineering
Type: Task
Status: Done Done
Priority: High
Reporter: Oskar Lund <oskar.lund@acme-hq.example>
Assignee: Oskar Lund <oskar.lund@acme-hq.example>
Labels: incidentcertificates
Components: infrastructure
Sprint: Sprint 49
Created: 20 Aug 2026, 14:00 UTC
Updated: 27 Aug 2026, 09:30 UTC
Resolved: 27 Aug 2026, 09:30 UTC

Description

OPS-39: the certificate for id.acme-hq.example was 6 days from expiry and its renewal had failed for two weeks. The failure emails went to an address that only forwarded to Piet, who left in July.

Daily check of every public hostname's certificate: page on-call at 21 days left, and again at 14.
A failed renewal pages on-call directly.
Every alarm and job notification goes to the paging rota or #ops, never to a person's mailbox. (Found six that didn't: four to Piet's old forward, two to Rafael.)

Linked issues

relates to OPS-39 Near miss: certificate for id.acme-hq.example 6 days from expiry, renewal failing for two weeks Done

Comments (0)

No comments.