Question

A financial services company experienced a production outage when a TLS certificate on a customer-facing API gateway expired without warning. The certificate was manually issued 12 months earlier by an internal CA, and the responsible engineer had left the company. The security architect is tasked with preventing recurrence across hundreds of internal and public-facing certificates. Which approach BEST addresses the root cause while supporting long-term operational resilience?

Accepted Answer

Implement an automated certificate lifecycle management platform integrated with the CA that handles enrollment, renewal, and revocation, with monitoring and expiration alerting

Answer

Extend all certificate validity periods to the maximum allowable duration to reduce the frequency of renewals and administrative overhead

Answer

Assign a dedicated staff member to maintain a spreadsheet of all certificates and manually renew each one 30 days before expiration

Answer

Switch all endpoints to self-signed certificates managed locally on each server to eliminate dependence on the internal CA