Certificate Renewal Desk: Expiries Worked Ahead of Time, Within the Weekly Ticket Cap

Certificates expire on their own schedule, not the team's

The renewal policy fits on one page. A certificate within 14 days of expiry is renewed now, and one within 30 days is renewed this week. A domain with no live deployment is retired rather than renewed, and a hostname covered by an active wildcard needs no certificate of its own. What makes the week hard is everything around those rules: a cap on renewal tickets so the platform team is not buried, owners who change teams or leave, and a wildcard whose retirement quietly changes the status of every hostname under it.

The inventory lives in Airtable, renewal tickets in ClickUp, deployments in Vercel and the policy in Google Drive. The weekly digest is a document the duty engineer writes by hand from all four, while owner replies trickle in through Slack and email. When a reversal or a retirement lands mid-week, the digest and the tickets drift apart, and the certificate that finally lapses tends to be the one whose owner left months ago.

Who works in the room

The team keeps one Kylon room for renewals, with Myco as its default agent, so a question about a certificate or the queue goes to Myco without anyone naming it. The room guidelines give digest review to Ada and anything addressed to an owner to Nova, so those requests route to them. Once the lead approves the week's list, Myco opens a thread for Ada whose first message is the brief: the approved actions, the cap and the carry-forward list, so the review starts from the same numbers.

A renewal week, Monday to close-out

An automation opens the week every Monday morning. Each stage below ends with a person, and nothing is written to Airtable or ClickUp until that person approves it in the thread.

Reversals, departures and a retired wildcard

Most mid-week changes are narrow. An owner writes in Slack that a staging domain is still used by a partner, so a retirement becomes a renewal. People operations updates the owner directory, and four certificates now belong to someone who left. Myco re-runs only the certificates each change touches and writes a short note on every Airtable record it changes, saying what moved and on whose word.

A wildcard retirement is the exception, because it reaches further than the notice suggests. When the lead retires the legacy wildcard, every hostname it covered loses that cover at once. Myco lists them all from the inventory itself, sends each one back through the full policy and ranks any new renewals against what is left of the cap. Whatever does not fit this week queues by expiry with the rest, and the run history shows exactly which records were read to build the list.

What the checks catch

• A thirteenth renewal ticket in a week capped at twelve, which waits in the queue instead of being created
• A certificate marked for retirement while its domain still has a live Vercel deployment
• Hostnames that lost their cover when the wildcard was retired, including ones the retirement notice never named
• Certificates still assigned to an owner who has left, found by checking the directory against every record and not only the ones due this week
• A digest correction note whose count per code does not match the lines it lists

What stays with people

• Approving the week's actions and every renewal ticket before it is created in ClickUp
• Deciding to retire a wildcard or a domain, and accepting an owner's evidence on a reversal
• Naming the new owner for a departed engineer's certificates
• Sending each notice to an owner, which Nova prepares as a Gmail draft

Integrations in this workflow

Kylon is not a certificate manager and it does not replace one. It reads the inventory, the tracker and the hosting platform the team already runs, and keeps the renewal work that spans all three in one room.

• Airtable
• ClickUp
• Gmail
• Google Drive
• Slack
• Vercel

• Airtable holds the certificate and domain inventory, with owners, expiry dates and wildcard cover
• ClickUp carries the renewal tickets, created only after the security lead approves the week's list
• Vercel shows which domains still have a live deployment, which decides between renew and retire
• Google Drive keeps the renewal policy, the cap and the weekly digest
• Gmail sends renewal and reassignment notices once a person sends Nova's draft
• Slack is where owners answer questions and where the per-owner close-out is posted after approval

Where to start

Start with one renewal week and the Airtable base that holds your certificates. Ask the base owner to approve a lasting grant so Myco can read it from the room, put the policy and the cap in a Drive folder the room can see, and write one rule in the room guidelines: agents classify and propose, and no ticket is created and no certificate retired until the security lead approves it.

“Retiring the old wildcard used to be the change nobody wanted to own. Now it is one approval and a list of every hostname it covered.”

Set it up with your agent

Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it.