Certificate Expiry Isn't the Same Problem as Secret Expiry

Vigil's earlier posts have mostly talked about "secrets expiring" as a category — connection strings, API keys, the things that quietly stop working one day. Certificates get lumped in with that, and mostly they behave the same way: Key Vault fires a near-expiry event once, about 30 days out, and nothing is subscribed to it unless you've built that wiring yourself. But certificates fail differently than secrets do, and the difference is worth calling out on its own.

A secret failing is usually binary

An expired API key stops authenticating. The call fails, the error is unambiguous, and whoever's on call can trace it back to "this key expired" in a few minutes.

A certificate failing is often messier

TLS certificates back services that other services trust implicitly — internal mTLS between microservices, a webhook endpoint another team depends on, an integration a partner built against months ago and hasn't touched since. When one of those certificates expires, the failure mode isn't always a clean error message. It can be a handshake that silently falls back to a degraded path, a client library that retries forever instead of surfacing the real problem, or a dependency three services away from the one anyone's actually watching.

The lead time problem is real, too

CertificateNearExpiry gives you one notification, ~30 days before expiry, if you've wired up Event Grid for it. Thirty days sounds like plenty of runway — until the certificate in question is issued by an external CA, requires a validation step, or needs sign-off from someone who's on vacation for two of those weeks. A secret can usually be rotated in minutes once someone notices. A certificate reissue can eat most of that 30-day window before it's actually deployed.

None of this is a Vigil-specific claim about how Key Vault works — it's the same CertificateNearExpiry event, the same one-time firing, the same per-vault Event Grid wiring gap that affects secrets and keys too. What's different is the cost of missing it. A missed secret expiry is usually an annoying incident. A missed certificate expiry, on something like internal service-to-service trust, tends to be a worse afternoon.