The server is running. The internet connection is healthy. Yet customers cannot complete an order because the browser no longer trusts the website’s certificate. A monitoring report can be entirely accurate and still miss the dependency that stopped the business.
For Malaysian SMEs outsourcing infrastructure or application support, certificate and domain renewal deserve an explicit operating agreement. Ask your MSP who notices an approaching expiry, who can authorise renewal and who confirms that the replacement actually works. Those may be three different people.
Build the register around business services
Start with the services the company would struggle to lose: its public website, order portal, remote-access service and important application integrations. For each, identify the hostname, certificate issuer, expiry date, deployment location, technical owner and business owner. Record whether renewal is automatic or manual, and where the evidence was last checked.
Keep the register useful without turning it into a credential store. It can reference an approved vault or access procedure; it should not contain private keys, passwords or payment-card details. Include a review date, so a certificate moved to a new gateway does not remain associated with an old server indefinitely.
Hypothetical example: a wholesaler’s website supplier renews the public certificate, while a separate provider manages the reverse proxy that presents it to customers. The new certificate exists in the supplier’s system, but the proxy still serves the old one. Both teams consider their part complete until someone tests the public endpoint.
Separate renewal, deployment and validation
These are different acceptance checks. Renewal produces a valid replacement. Deployment puts it into the application or network component that needs it. Validation confirms the intended service presents a trusted certificate for the right hostname and still completes its business function.
Microsoft’s App Service documentation illustrates why the distinction matters. Its free managed certificate renews automatically while the required prerequisites remain satisfied, and associated bindings are updated. An uploaded certificate does not receive an automatic binding update. “Azure handles it” is therefore too broad: the operating record must identify the actual certificate arrangement.
Similarly, Key Vault renewal guidance explains that renewal creates a new version for an integrated-CA certificate. Your operating check should establish how the consuming service follows or receives that version. Seeing a new certificate in a vault is useful evidence, but the customer-facing endpoint needs its own check.
Make an expiry alert start work
An email reminder is only the beginning. Agree a route from detection to an owned ticket, then to escalation if the task remains open. The ticket should identify the affected service, expiry, required action and person who can resolve any approval or access blocker.
For certificates managed in Azure Key Vault, Microsoft documents routing lifecycle events through Event Grid to Azure Monitor alerts. Near-expiry events provide a 30-day warning. That is a capability to configure and verify, not evidence that every vault already notifies the right team. Other hosting platforms need their own supported monitoring arrangement.
Set your operational deadlines according to renewal lead time and business impact. A provider waiting for manual identity checks may need a different escalation point from an automated service. Ask for a controlled alert-path test and record who received it. Do not let a production certificate expire to prove the monitoring works.
Track the domain as a separate dependency
The domain registration and TLS certificate have different lifecycles. A valid certificate cannot compensate for an expired domain registration. ICANN’s renewal guidance stresses timely renewal, payment and current registrar contact information. For Malaysian country-code domains, check the applicable registry and registrar’s terms rather than assuming generic-domain procedures apply.
Record which organisation controls the registrar account, where notices arrive and who owns payment approval. If the MSP operates the account, document the customer’s ownership and recovery arrangements. Avoid relying on one employee’s personal inbox or an expired payment method. Auto-renewal should be checked for successful completion, rather than treated as an annual promise.
Use change and recovery procedures that fit the risk
Before replacement, confirm the affected endpoints, change window, installation procedure and approved recovery plan. A valid old certificate may be usable during a controlled rollback; an expired or revoked one is not a safe recovery target. Do not teach staff to bypass browser warnings to keep working.
Afterwards, test the hostname and trust chain from the intended user path, including any proxy or load balancer. Then complete a representative transaction using approved test data. Internal access and external access may reach different components, so note which route was tested and by whom.
What to ask for at the next service review
Request a concise report showing certificates and domains approaching their agreed action dates, unresolved ownership gaps and completed renewals awaiting validation. Sample one completed item: follow its alert, approval, deployment record and endpoint check. Connect any exclusions to the wider managed-service scope.
The useful outcome is a repeatable chain of responsibility. Your team should know what is due, who can act and which evidence closes the work. To discuss clearer infrastructure and application operating responsibilities, contact AXO Technologies.
Sources and dates
Published 28 October 2026. Primary sources accessed on 28 October 2026. Access dates are not publication dates; this article provides operating guidance, not a report of an AXO or client incident.
- Microsoft: add and manage TLS/SSL certificates in App Service — maintained product documentation; checked 28 October 2026.
- Microsoft: renew Key Vault certificates — page updated 10 April 2026; checked 28 October 2026.
- Microsoft: handle Key Vault events using Azure Monitor alerts — page updated 27 August 2026; checked 28 October 2026.
- ICANN: renewing domain names — maintained registrant guidance; checked 28 October 2026.