The only way to make sure you don't get bitten by things like certificate expiration is to exercise update path often, and the more often the better.