Design Certificate Management - System Design | WinJob

Problem Statement: Enterprise Certificate Lifecycle Platform

Frame certificate lifecycle as operable machinery—not a shopping list of PKI buzzwords.

What to state early

Manual cert spreadsheets cause midnight expiry pages
Public edge TLS and internal mTLS need one governance plane
Renewal must be scheduled like a distributed job system

Mechanism

Separate control plane (policy, issuance API, scheduler) from data plane (terminators reload material). Default deny for wildcards; renew at two-thirds of lifetime.

Failure and degradation

When certificate lifecycle dependencies fail, freeze wildcard issuance, extend overlap windows, and page if any production hostname drops below 14 days remaining. Never revoke the only valid version until adapter acks exceed 99% and TLS error rates stay flat.

Cost and operability

Let's Encrypt proved automated public TLS; enterprises still need Venafi-class approvals, HSM-backed CA keys, and immutable audit for SOC2.

javaOne Dark Pro

1 public final class RenewalGate {
2   private RenewalGate() {}
3   public static boolean shouldProceed(String certId, long daysRemaining, boolean policyOk) {
4     return certId != null && !certId.isBlank() && daysRemaining > 0 && policyOk;
5   }
6 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass(frozen=True)
4 class CertificateRecord:
5     cert_id: str
6     sans: list[str]
7  
8 def allow_action(ctx: CertificateRecord, days_remaining: int, policy_ok: bool) -> bool:
9     return bool(ctx.cert_id) and days_remaining > 0 and policy_ok

typescriptOne Dark Pro

1 interface CertVersion {
2   certId: string;
3   version: number;
4   notAfter: string;
5 }
6  
7 export function canPromote(cert: CertVersion, minOverlapHours: number): boolean {
8   const msLeft = new Date(cert.notAfter).getTime() - Date.now();
9   return msLeft > minOverlapHours * 3600 * 1000;
10 }

Deep dive

Let's Encrypt proved automated public TLS; enterprises still need Venafi-class approvals, HSM-backed CA keys, and immutable audit for SOC2.

How to open this one

The framing that signals depth on certificate management is automated lifecycle with expiry as the enemy: issue, distribute, rotate, and revoke certs continuously, because the classic outage is a cert nobody renewed expiring at 2 a.m. Lead with short-lived certs plus automated renewal (ACME, a CA hierarchy with an offline root), and the failure story that proves it: a renewal pipeline silently fails and a leaf cert expires in production. That shows you understand the goal is to make expiry a non-event, not to track renewal dates in a spreadsheet.

Key Highlights

•Manual cert spreadsheets cause midnight expiry pages
•Public edge TLS and internal mTLS need one governance plane
•Renewal must be scheduled like a distributed job system

1	public final class RenewalGate {
2	private RenewalGate() {}
3	public static boolean shouldProceed(String certId, long daysRemaining, boolean policyOk) {
4	return certId != null && !certId.isBlank() && daysRemaining > 0 && policyOk;
5	}
6	}

1	from dataclasses import dataclass
2
3	@dataclass(frozen=True)
4	class CertificateRecord:
5	cert_id: str
6	sans: list[str]
7
8	def allow_action(ctx: CertificateRecord, days_remaining: int, policy_ok: bool) -> bool:
9	return bool(ctx.cert_id) and days_remaining > 0 and policy_ok

1	interface CertVersion {
2	certId: string;
3	version: number;
4	notAfter: string;
5	}
6
7	export function canPromote(cert: CertVersion, minOverlapHours: number): boolean {
8	const msLeft = new Date(cert.notAfter).getTime() - Date.now();
9	return msLeft > minOverlapHours * 3600 * 1000;
10	}

Problem Statement: Enterprise Certificate Lifecycle Platform

What to state early

Mechanism

Failure and degradation

Cost and operability

Deep dive

How to open this one

Key Highlights

Section Rescue Kit