A fleet of gateways is really a fleet of certificates. Each endpoint needs a valid, trusted certificate at all times, and an expired one is the single most common cause of a connection that suddenly stops working for everyone at once.
We treat renewal as an operational discipline rather than a calendar reminder. Issuance and expiry are tracked centrally, renewals happen well ahead of the deadline, and every change is monitored end to end so we see a problem before a user does.
Keeping the surface tidy
We also keep the naming of our endpoints simple and consistent, so the estate is easy to reason about and easy to rotate. Consolidating coverage under a small number of certificates, rather than a sprawl of one-off names, keeps the whole thing maintainable as the number of points of presence grows.