D

TLS Certificate Expired

Confirm, diagnose and recover from an expired TLS certificate on a public endpoint.

On this page

Browsers and API clients both fail hard on an expired certificate — this is one of the few outages that's usually 100% preventable with monitoring, and 100% urgent once it happens because every client refuses the connection.

Confirm the expiry directly

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate

Checks the certificate a live server is actually presenting, not what you think is deployed.

Check every hostname the certificate covers

openssl x509 -in cert.pem -noout -text | grep -A1 'Subject Alternative Name'

A multi-domain (SAN) certificate can have one covered name expire independently in practice if it was reissued for a subset — confirm the specific hostname that's failing is actually on the current cert.

Identify the renewal mechanism

Is this certificate managed by ACM (auto-renews, attached to an ALB/CloudFront), cert-manager in Kubernetes (auto-renews via ACME), or a manually issued and manually installed certificate? The fix path is completely different for each.

Renew and redeploy

kubectl get certificate -A

For cert-manager: lists managed certificates and their Ready status — a stuck renewal usually shows a clear reason in describe.

kubectl describe certificate CERT_NAME -n NAMESPACE

Shows why a cert-manager renewal failed — commonly a broken ACME HTTP-01/DNS-01 challenge, like a DNS record pointing at the wrong place.

For a manually managed certificate, obtain the renewed cert and private key, deploy it to every place it's terminated (load balancer, ingress controller, reverse proxy), and reload — a partial rollout leaves some paths still serving the expired one.

Confirm from a clean client

curl -vI https://example.com

Confirms the new certificate is actually being served and trusted, from a client with no cached state about the old one.

This should never be a surprise

Certificate expiry is a known, calendar-predictable date the moment it's issued. Alert on days-until-expiry (30/14/3 days out) rather than finding out from a client-facing outage — ACM and cert-manager both auto-renew, but only when the renewal mechanism itself is actually healthy.