It starts with a few tickets. Sign-in fails, an integration throws an error, an app won't load. Within the hour there are dozens. Everyone looks at the last release, the server, the database. Only much later does someone think to check whether something expired. And that turns out to be it: a client secret from two years ago, created by someone who hasn't looked at it since.
We ran into this twice ourselves with a production app. Renewing took five minutes. Finding it took a morning.
What quietly expires in IT
Almost everything systems use to trust each other has an end date. And each one lives in a different portal, with a different lifetime.
- Client secrets and certificates on app registrations in Microsoft Entra ID. The portal lets you pick a lifetime of up to 24 months, and then the date is out of sight.
- TLS certificates for websites and APIs. Since 15 March 2026 a public certificate can be valid for at most 200 days, from 15 March 2027 at most 100 days, and from 2029 at most 47 days. That means many more expiry dates to keep up with.
- Domain names. When a domain lapses, website and email stop together, and after the grace period someone else can register it.
- API keys and tokens for outside services, such as a payment provider, an email service or a maps service.
- The Apple push certificate for device management, which has to be renewed every year. Let it lapse and, in the worst case, devices have to be enrolled again.
- Code signing certificates, licences and support contracts.
Why the cause takes so long to find
An expired secret doesn't look like an expired secret. Users see a vague error or a blank screen. Only deep in the logs is there something like AADSTS7000222, the Entra ID message saying the client secret has expired. With an API key it's often a bare 401, with a certificate a connection that gets refused.
On top of that, hardly anyone thinks of a date first during an outage. The first suspect is always the last change. But with an expiry date there is no change. Nothing changed, except the calendar.
What it costs, a worked example
Take an internal app that's down for a morning, four hours. A worked example with our own assumptions, so plug in your own numbers.
- Diagnosis: three people spend four hours looking for the cause. That's 12 hours.
- Support: 40 tickets at an average of 10 minutes, including follow-up. That's almost 7 hours.
- Users: 50 colleagues who can't work properly for two hours. That's 100 hours.
Together, over 115 hours. At an internal cost of 60 euros an hour that's close to 7,000 euros, before lost revenue, unhappy customers or an evening of overtime. The renewal itself takes five minutes. The whole difference is in when you see it.
See it coming months ahead
The fix isn't searching smarter during the outage, it's making sure the outage doesn't happen. For that you need two things: every expiry date in one place, and a warning that reaches more than one person in time.
In OwndUp you make a list for it, for example "What expires in our IT", with your own columns: what it is, type, system, where it's used, who renews it, expiry date, and a link to the renewal steps. Never put the secret or key itself in the list. OwndUp isn't a vault, the list only tracks when something expires and who owns it.
You hang a reminder on the expiry date, by default three months, one month and one week ahead. It goes by email and in the app to everyone the list is shared with, so not just to the colleague who created the secret back then. If you like, it also lands in a Teams channel. If a reminder sits untouched, OwndUp can escalate it to a backup after a week, so it doesn't quietly fade.
When you renew the secret, you put the new date in the list and the reminders re-arm for next time. In two years nobody has to remember it.
And if it does go wrong once
The list helps then too. Your dashboard opens with what needs action now, across all your lists: what has already expired first, then what runs out soon. During an outage nobody can explain, that's the first place to look: what expired today or yesterday? You get that answer in ten seconds instead of after a morning of searching.