The agency took on a client with an unusually sprawling infrastructure: roughly forty subdomains, each representing a different regional or product-line microsite, each with its own individually purchased and manually renewed certificate — some from one CA, some from another, expiry dates scattered essentially at random across the calendar depending on whenever each one had originally been set up.
The state things were actually in
There was no central inventory. The previous team's approach had been, as far as anyone could reconstruct, "whoever set up a given subdomain also became responsible for remembering to renew its certificate" — an approach that had predictably decayed as team members left and responsibilities blurred. Two subdomains were found to be running on certificates that had already silently expired weeks earlier, discovered only because the migration project specifically went looking, not because anyone had been alerted.
The actual migration process
The first step wasn't touching a single certificate — it was building an actual inventory. A scripted scan connected to all forty known subdomains, recorded each one's current certificate issuer, expiry date, and validation type, and produced the first complete picture anyone on the current team had ever had of the client's real certificate footprint. That inventory alone surfaced the two already-expired certificates immediately.
From there, the team consolidated everything onto a single ACME-automated workflow, standardizing on Let's Encrypt with a shared renewal script running across all forty subdomains on a single schedule, rather than forty independent, manually-tracked processes. A handful of subdomains needed individual attention first — a couple had DNS configurations that didn't cleanly support the chosen validation method, requiring small adjustments before they could join the automated batch — but within about two weeks, all forty were on one consistent, monitored renewal process.
What made this genuinely hard, beyond the technical work
The actual difficulty wasn't the automation itself — ACME tooling handles bulk renewal well once you're set up for it, see our bulk renewal guide for the mechanics. The harder part was the discovery phase: figuring out what actually existed before deciding how to fix it, since "we don't have a complete list of our own subdomains" is a more common state for a growing infrastructure to end up in than most teams would guess going in. Our certificate discovery guide covers the same scanning approach that surfaced this client's two silently-expired certificates before they became a customer-facing incident.
This case study is written to illustrate a genuine, common troubleshooting pattern. It is not a direct quotation or a verified account tied to a specific, identifiable individual or company. For the underlying technical reference, see: Bulk-Renewing Multiple Domain Certificates · Certificate Auto-Discovery for Many Domains
Loading comments…