# Using observability to verify TLS certificate rotation in production

DevFeed: [Using observability to verify TLS certificate rotation in production](<https://devfeed.tech/articles/your-tls-rotation-is-not-reliable-until-production-proves-it-34025.md>)

Original publisher: [Read original article](<https://sridharrajarao.com/blog/tls-rotation-observability/>)

Author: Sridhar Rajarao

Published: 2026-08-13T00:00:00Z

Content type: article

Language: en

Sources: [Sridhar Rajarao](<https://devfeed.tech/sources/sridhar-rajarao.md>)

Topics: [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [observability](<https://devfeed.tech/topics/observability.md>), [TLS handshake](<https://devfeed.tech/topics/tls-handshake.md>), [Automation](<https://devfeed.tech/topics/automation.md>), [nginx](<https://devfeed.tech/topics/nginx.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>)

Tags: [automation](<https://devfeed.tech/tags/automation.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [observability](<https://devfeed.tech/tags/observability.md>), [reliability](<https://devfeed.tech/tags/reliability.md>), [sre](<https://devfeed.tech/tags/sre.md>), [tls](<https://devfeed.tech/tags/tls.md>), [tls-handshake](<https://devfeed.tech/tags/tls-handshake.md>)

## AI overview

The article explains that automating certificate renewal does not prove that production endpoints serve the new certificate. It recommends externally probing customer-facing endpoints and measuring certificate details and real TLS handshakes across proxies, regions, ingress controllers, CDNs, gateways, and other endpoints.

## Source excerpt

Automation renews a certificate. Observability proves every endpoint is serving it and customers can complete a TLS handshake.