{"course":{"slug":"cloud-and-shipping","title":"Shipping It","url":"https://addaly.com/learn/cloud-and-shipping","level":"intermediate","track":"build"},"lesson":{"slug":"the-things-that-expire","title":"Everything expires, and nothing tells you","url":"https://addaly.com/learn/cloud-and-shipping/the-things-that-expire","position":42,"of":74,"minutes":8,"answer":"Most preventable outages are something with a date on it that nobody owned, so keep one file listing what expires, when, and on whose card.","keyIdea":"Most preventable outages are something with a date on it that nobody owned, so keep one file listing what expires, when, and on whose card."},"body":{"format":"markdown","text":"## The least glamorous lesson here\n\nIt prevents more downtime than anything in this course except backups.\n\nA live product is held up by a dozen things that have expiry dates. None of them fail because of load or bugs. They fail on a specific day, usually to nobody's surprise except everybody's.\n\n## The list\n\n**The domain.** The one that ends the product rather than degrades it. The usual sequence: the card on file expired, auto-renew failed silently, the notification went to an address nobody reads. After expiry there is typically a grace period of about 30 days during which you can renew normally, then a **redemption period** where recovery costs a restore fee: commonly $80 to $150, against a renewal of $11. After that it can be registered by anyone, and domains that have carried traffic are bought within minutes.\n\nRegister for several years at once, turn on auto-renew, keep the card current, and turn on the registrar's transfer lock (`clientTransferProhibited`) so nobody can move it away.\n\n**The TLS certificate.** Covered in module one. Worth repeating here because Let's Encrypt no longer sends expiry warnings, so a broken renewal is now completely silent until the site goes red.\n\n**OAuth client secrets and API keys.** Google OAuth client secrets, Apple's signing keys, some payment provider keys: several have hard expiry dates measured in months. When they expire, sign-in stops working for everybody at once, on a date that was known a year in advance.\n\n**Every card on file.** One card, five vendors, one expiry date. When it expires you get five failures across a week, in the order the vendors happen to bill.\n\n**Free tiers and trial credits.** A cloud trial with $300 of credit ends. A \"free for 12 months\" tier starts charging. A database free tier changes its terms. This is the availability half of what the billing lesson covered: some services suspend rather than bill.\n\n**Deprecated APIs with a sunset date.** The provider emailed the address on the account, which is the personal address of somebody who left in March.\n\n**Your own monitoring's free tier.** The check that would have told you stopped running, quietly, and its silence looks exactly like health.\n\n## The fix is one file and one calendar\n\nNothing sophisticated. A `RENEWALS.md` in the repository:\n\n```\ndomain addaly.com   registrar: X   renews 2027-03-14  auto-renew ON  card ending 4412\nTLS                 Let's Encrypt  auto, 90d          monitor: cert-expiry check\nGoogle OAuth secret expires 2027-01-08                rotate procedure: docs/…\nCloud account       card ending 4412                  expires 06/28\nMail provider       free tier 300/day                 review 2027-01\n```\n\nThen a calendar event 30 days before each, and (this is the part that makes it work) **use a role address, not a person's.** Every vendor account registered to `ops@yourdomain`, forwarded to whoever is currently responsible. Personal addresses are how the sunset email reaches nobody.\n\n## Two checks worth automating today\n\n```bash\n# domain expiry\nwhois addaly.com | grep -iE 'expir'\n\n# certificate expiry\necho | openssl s_client -connect addaly.com:443 -servername addaly.com 2>/dev/null \\\n  | openssl x509 -noout -enddate\n```\n\nWrap both in a scheduled job that alerts at 45 days for the domain and 21 for the certificate. It is twenty lines and it retires two of the most avoidable outages there are.\n\n## The habit underneath\n\nWhen you add anything that has a date (a key, a card, a plan, a contract) the same moment you add it, write the line in the file and make the calendar entry. Not later. Later is where these live until they expire.\n\nThis is a small discipline that reads as bureaucratic and is not. It is the difference between a product that quietly keeps working and one that has a bad Tuesday every few months for reasons that were all knowable in advance."},"check":{"question":"Your site goes down completely. DNS lookups for your domain return nothing, the servers are healthy, and no deploy has happened for two weeks. What should you check first?","options":[{"text":"Whether the domain registration lapsed, most likely because auto-renew failed on an expired card","correct":true},{"text":"Whether the TLS certificate expired, since that also takes the whole site offline","correct":false,"tempting":"A certificate expiry produces a browser warning on a site that still resolves and responds; here the name does not resolve at all."},{"text":"Whether the DNS provider is having an outage affecting your zone","correct":false,"tempting":"Worth checking second, and it happens, but a provider outage is public within minutes and does not follow a two-week period of no changes as neatly as a billing date does."},{"text":"Whether a recent DNS record change propagated incorrectly","correct":false,"tempting":"Ruled out by the facts given: no change has been made for two weeks, and DNS answers do not degrade on their own after propagating."}]},"prev":{"slug":"data-you-must-delete","title":"Data you must keep, and data you must delete","url":"https://addaly.com/learn/cloud-and-shipping/data-you-must-delete"},"next":{"slug":"failing-well","title":"Timeouts, retries, and the failure you made worse","url":"https://addaly.com/learn/cloud-and-shipping/failing-well"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Everything expires, and nothing tells you', in Shipping It. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/cloud-and-shipping/the-things-that-expire (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Everything expires, and nothing tells you","courseTitle":"Shipping It","module":{"index":5,"slug":"staying-alive","title":"Staying alive: the bad day and the day after"},"answer":null,"keyIdea":"Most preventable outages are something with a date on it that nobody owned, so keep one file listing what expires, when, and on whose card.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"the-least-glamorous-lesson-here","runs":[{"text":"The least glamorous lesson here"}]},{"t":"p","runs":[{"text":"It prevents more downtime than anything in this course except backups."}]},{"t":"p","runs":[{"text":"A live product is held up by a dozen things that have expiry dates. None of them fail because of load or bugs. They fail on a specific day, usually to nobody’s surprise except everybody’s."}]},{"t":"h2","id":"the-list","runs":[{"text":"The list"}]},{"t":"p","runs":[{"text":"The domain.","b":true},{"text":" The one that ends the product rather than degrades it. The usual sequence: the card on file expired, auto-renew failed silently, the notification went to an address nobody reads. After expiry there is typically a grace period of about 30 days during which you can renew normally, then a "},{"text":"redemption period","b":true},{"text":" where recovery costs a restore fee: commonly $80 to $150, against a renewal of $11. After that it can be registered by anyone, and domains that have carried traffic are bought within minutes."}]},{"t":"p","runs":[{"text":"Register for several years at once, turn on auto-renew, keep the card current, and turn on the registrar’s transfer lock ("},{"text":"clientTransferProhibited","code":true},{"text":") so nobody can move it away."}]},{"t":"p","runs":[{"text":"The TLS certificate.","b":true},{"text":" Covered in module one. Worth repeating here because Let’s Encrypt no longer sends expiry warnings, so a broken renewal is now completely silent until the site goes red."}]},{"t":"p","runs":[{"text":"OAuth client secrets and API keys.","b":true},{"text":" Google OAuth client secrets, Apple’s signing keys, some payment provider keys: several have hard expiry dates measured in months. When they expire, sign-in stops working for everybody at once, on a date that was known a year in advance."}]},{"t":"p","runs":[{"text":"Every card on file.","b":true},{"text":" One card, five vendors, one expiry date. When it expires you get five failures across a week, in the order the vendors happen to bill."}]},{"t":"p","runs":[{"text":"Free tiers and trial credits.","b":true},{"text":" A cloud trial with $300 of credit ends. A “free for 12 months” tier starts charging. A database free tier changes its terms. This is the availability half of what the billing lesson covered: some services suspend rather than bill."}]},{"t":"p","runs":[{"text":"Deprecated APIs with a sunset date.","b":true},{"text":" The provider emailed the address on the account, which is the personal address of somebody who left in March."}]},{"t":"p","runs":[{"text":"Your own monitoring’s free tier.","b":true},{"text":" The check that would have told you stopped running, quietly, and its silence looks exactly like health."}]},{"t":"h2","id":"the-fix-is-one-file-and-one-calendar","runs":[{"text":"The fix is one file and one calendar"}]},{"t":"p","runs":[{"text":"Nothing sophisticated. A "},{"text":"RENEWALS.md","code":true},{"text":" in the repository:"}]},{"t":"code","lang":"","label":"Text","text":"domain addaly.com   registrar: X   renews 2027-03-14  auto-renew ON  card ending 4412\nTLS                 Let's Encrypt  auto, 90d          monitor: cert-expiry check\nGoogle OAuth secret expires 2027-01-08                rotate procedure: docs/…\nCloud account       card ending 4412                  expires 06/28\nMail provider       free tier 300/day                 review 2027-01"},{"t":"p","runs":[{"text":"Then a calendar event 30 days before each, and (this is the part that makes it work) "},{"text":"use a role address, not a person’s.","b":true},{"text":" Every vendor account registered to "},{"text":"ops@yourdomain","code":true},{"text":", forwarded to whoever is currently responsible. Personal addresses are how the sunset email reaches nobody."}]},{"t":"h2","id":"two-checks-worth-automating-today","runs":[{"text":"Two checks worth automating today"}]},{"t":"code","lang":"bash","label":"Bash","text":"# domain expiry\nwhois addaly.com | grep -iE 'expir'\n\n# certificate expiry\necho | openssl s_client -connect addaly.com:443 -servername addaly.com 2>/dev/null \\\n  | openssl x509 -noout -enddate"},{"t":"p","runs":[{"text":"Wrap both in a scheduled job that alerts at 45 days for the domain and 21 for the certificate. It is twenty lines and it retires two of the most avoidable outages there are."}]},{"t":"h2","id":"the-habit-underneath","runs":[{"text":"The habit underneath"}]},{"t":"p","runs":[{"text":"When you add anything that has a date (a key, a card, a plan, a contract) the same moment you add it, write the line in the file and make the calendar entry. Not later. Later is where these live until they expire."}]},{"t":"p","runs":[{"text":"This is a small discipline that reads as bureaucratic and is not. It is the difference between a product that quietly keeps working and one that has a bad Tuesday every few months for reasons that were all knowable in advance."}]}],"check":{"question":[{"text":"Your site goes down completely. DNS lookups for your domain return nothing, the servers are healthy, and no deploy has happened for two weeks. What should you check first?"}],"options":[{"text":[{"text":"Whether the domain registration lapsed, most likely because auto-renew failed on an expired card"}],"correct":true,"tempting":null},{"text":[{"text":"Whether the TLS certificate expired, since that also takes the whole site offline"}],"correct":false,"tempting":[{"text":"A certificate expiry produces a browser warning on a site that still resolves and responds; here the name does not resolve at all."}]},{"text":[{"text":"Whether the DNS provider is having an outage affecting your zone"}],"correct":false,"tempting":[{"text":"Worth checking second, and it happens, but a provider outage is public within minutes and does not follow a two-week period of no changes as neatly as a billing date does."}]},{"text":[{"text":"Whether a recent DNS record change propagated incorrectly"}],"correct":false,"tempting":[{"text":"Ruled out by the facts given: no change has been made for two weeks, and DNS answers do not degrade on their own after propagating."}]}],"order":[3,2,0,1],"why":null},"prev":{"slug":"data-you-must-delete","title":"Data you must keep, and data you must delete","minutes":9},"next":{"slug":"failing-well","title":"Timeouts, retries, and the failure you made worse","minutes":9}}}