The Spreadsheet That’s Supposed to Track Your Certificates
Somewhere in your organization — on a SharePoint site, a shared drive, or in someone’s personal OneDrive — there’s a spreadsheet that’s supposed to track your certificates.
It has columns like “Server Name,” “Expiry Date,” “Template,” “Owner,” and maybe “Notes.” It was created with good intentions by someone who was tired of certificate surprises. It was maintained diligently. For about three months.
Now? It’s stale. Incomplete. Missing the last 6-12 months of certificate activity. And everyone knows it — they just don’t want to be the one responsible for updating it.
Why the Spreadsheet Exists
The spreadsheet is a symptom of a real problem: no native tool in AD CS provides a unified, actionable view of your certificate estate.
The CA database shows what was issued. certutil can query it. The MMC snap-in shows individual stores. But none of these provide:
- A single view across all servers
- Expiry alerting
- Ownership tracking
- Deployment status
- Historical change tracking
So someone builds a spreadsheet. It’s the path of least resistance.
The Lifecycle of Every Certificate Spreadsheet
Every certificate tracking spreadsheet follows the same lifecycle:
Phase 1: Creation (Week 1) — Someone gets burned by a certificate outage. They export the CA database. They add columns. They feel productive.
Phase 2: Maintenance (Weeks 2-12) — The creator updates it after each renewal. Team members occasionally contribute. It’s mostly accurate.
Phase 3: Drift (Months 3-6) — The creator gets busy. New certificates get issued without updates. Entries become stale.
Phase 4: Abandonment (Months 6-12) — Nobody trusts the data anymore. People check actual servers instead.
Phase 5: Rebirth (After the Next Outage) — A new outage happens. A new spreadsheet is created. Return to Phase 1.
Average time from creation to uselessness: 3-6 months.
Seven Reasons Spreadsheets Fail
1. No Auto-Discovery
A spreadsheet only contains what someone manually entered. If a certificate exists but nobody told the spreadsheet, it’s invisible.
2. No Alerting
Expiry dates in cells don’t send emails, don’t escalate, don’t page anyone. You have to actively LOOK at the spreadsheet.
3. Stale Data from Day One
The moment you finish populating it, it starts becoming inaccurate. Certificates get renewed, deployed, decommissioned — without spreadsheet updates.
4. Single Point of Human Failure
The spreadsheet depends entirely on humans remembering to update it after every single change.
5. No Deployment Verification
A spreadsheet can track what the CA issued. It cannot verify whether the certificate is actually serving traffic.
6. Scale Failure
Spreadsheets sort-of work with 50 certificates. They fail at 200+.
7. False Sense of Security
The most dangerous aspect: the spreadsheet’s existence makes people think they have tracking. “Do we track certificates?” → “Yes, we have a spreadsheet.” But it’s 6 months stale.
What Spreadsheets Track vs. What You Need
| Requirement | Spreadsheet | Proper Tool |
|---|---|---|
| Auto-discovery | Manual only | Continuous scanning |
| Real-time expiry | Static date | Dynamic countdown |
| Alerting | None | 90/30/14/7/1 day |
| Deployment status | What was issued | What’s actually serving |
| Scale (500+ certs) | Unmaintainable | Automated |
| New cert detection | Only if entered | Automatic |
What Actually Works
Replacing the spreadsheet requires:
- Automated discovery — scan endpoints, find certificates without human input
- Continuous sync — data stays current automatically
- Proactive alerting — expiry warnings go to owners before anything breaks
- Deployment verification — confirms what’s serving traffic, not just what was issued
- Ownership management — tracks and validates who’s responsible
- Scale-independent — works the same for 50 or 5,000 certificates
The goal isn’t a better spreadsheet. It’s eliminating the need for manual tracking entirely.
Your certificate spreadsheet isn’t a tracking system. It’s a snapshot that started degrading the moment it was created. Replace it with something that stays current without relying on human memory.
Tags: Certificate Tracking, Spreadsheet, Certificate Inventory, AD CS, PKI, Certificate Lifecycle Management, CLM