How do you guys deal with SSLs?

Automate as much as feasible. Notably including tracking, monitoring, installation/updating, etc. And be sure to track all certs issued - generally cover this via policy and enforcement thereof. And include tracing where they get installed, responsible group(s)/department(s)/persons and relevant contact info., etc. because scanning and such won't find 'em all - though you'll want to do that too, as that will give you pretty good monitoring on *most* of them. As for monitoring/reporting, I quite like my [nmap\_cert\_scan\_summarize](https://www.mpaoli.net/~michael/bin/nmap_cert_scan_summarize). E.g.: $ (TZ=GMT0 export TZ; ports=443; hosts='www.reddit.com www.google.com www.example.com'; nmap -v -Pn -r -sT -p "$ports" --resolve-all --script=ssl-cert $hosts 2>&1; nmap -v -6 -Pn -r -sT -p "$ports" --resolve-all --script=ssl-cert $hosts 2>&1) | nmap_cert_scan_summarize expires SAN_or_CN: IP port [host] ... expires IP port [host] SANorCN 2025-04-11T23:59:59Z 151.101.73.140 443 www.reddit.com *.reddit.com,reddit.com 2025-04-28T08:37:54Z www.google.com: 142.250.189.164 443 www.google.com 2607:f8b0:4005:80c::2004 443 www.google.com 2026-01-15T23:59:59Z *.example.com,example.com: 23.192.228.68 443 www.example.com 23.192.228.85 443 www.example.com 2600:1406:3a00:21::173e:2e65 443 www.example.com 2600:1406:3a00:21::173e:2e66 443 www.example.com $