Rotate credentials before the usable trust window closes

Start from the earliest operational deadline relevant to the deployed path and policy. A leaf might have several days left while an intermediate expires sooner. Issuance can also depend on a reachable control plane or successful challenge, so include retries and recovery time rather than assuming instantaneous replacement. Automated protocols such as ACME standardize important issuance interactions, but issuance authorization is not proof that every process has reloaded the resulting key and chain or that the service's application permissions are correct.

Allocate time for issuing, distributing, reloading, and verifying credentials, plus an explicit uncertainty margin. Clock skew and scheduling delays matter near validity boundaries; do not rely on all hosts sharing an exact second. Monitoring should inspect the certificates served by each relevant termination point and the paths actually built by clients. A file on disk can be current while a process continues to serve an old in-memory certificate, especially when reload failure is silently ignored.

Replacing a leaf under an already trusted issuer differs from migrating issuer trust. For an issuer change, a common controlled sequence is to distribute trust for the new issuer, verify that clients have it, deploy new leaves, then remove old trust when the migration and retirement policy permit. Reversing those steps can strand otherwise healthy workloads. The overlap period temporarily accepts more than one credential lineage, so define its scope and end rather than leaving obsolete trust indefinitely for convenience.

Revocation and expiry address different events. Revocation signals that a certificate should no longer be accepted under the relying party's policy before its natural expiry. CRL and OCSP evidence have freshness, distribution, and failure-handling requirements. An OCSP good response is a scoped status statement, not a complete proof of correct issuance, matching name, or authorization. Decide how unavailable or stale status evidence affects acceptance; soft failure and hard failure trade different risks. A rotation does not automatically revoke every old credential or destroy retained resumption material.

A certificate is normally checked during the relevant authentication event. Its later expiry does not by itself guarantee that every already established TLS connection is immediately terminated. Session resumption can also use previously established context under its own acceptance rules. If incident policy requires rapid removal of a compromised identity, address active connections, resumption credentials, trust and revocation propagation, and application sessions explicitly. Replacing a leaf file is only one part of that response.

The Markov lab illustrates a fictional rollout process with state 0 meaning old credential and state 1 meaning new. Reset, set both forward probability p=0.25 and rollback probability q=0, predict the old-state fraction after four transitions, then press Step four times. It is 0.75⁴, about 0.316. For a separate rollback case, Reset and set both p=0.25,q=0.05 before predicting and stepping. These exact probabilities assume the same transition rule at every interval; playback is not measured fleet data or certificate validation. Still probe deployment groups with fresh handshakes and verify actual retirement behavior.