Every TLS certificate has a fixed expiration date. A manually-managed one depends entirely on a human remembering to renew it — it works perfectly right up to the last second, giving no warning, and the instant it expires every client's trust check fails at once: total, immediate, simultaneous outage.
An ACME-based automated renewal system instead watches the expiry date continuously and requests a fresh certificate a comfortable margin before it (here, 30 days ahead of a 90-day cert). The swap happens silently — the countdown just resets — so the certificate is never actually reaching expiry while serving traffic.
- Manual / unmonitored — the ring drains to zero, the tower and every client flash red simultaneously, and connections keep failing until you click the renew button.
- Automated ACME — the ring never reaches zero; it resets itself near the 30-day mark with a brief green renewal pulse, and clients never see a failure.