Certificate Expired
Your TLS certificate has passed its validity end date. Browsers will show a full-page warning and most clients will refuse to connect.
What You Will See
The browser displays "Your connection is not private" or "SEC_ERROR_EXPIRED_CERTIFICATE". API clients and automated tools fail with TLS handshake errors. Monitoring systems fire alerts for certificate validity.
Common Causes
- Auto-renewal failed. Let's Encrypt certbot is misconfigured, the renewal hook did not run, or the ACME challenge could not be completed.
- Renewal succeeded but was not deployed. The new certificate file exists on disk but the web server or load balancer is still serving the old one.
- Manually provisioned certificate with no expiry tracking. Someone ordered the cert months ago and no one set a reminder.
- Load balancer serving a stale certificate. The cert was updated on one node but not propagated to all edges or listeners.
How to Diagnose
Use the TLS Inspector to check the current certificate's validTo date. Compare this with the expected renewal date from your CA dashboard or certbot logs. Verify that the certificate being served by the server matches what your CA shows as the latest issuance.
How to Fix
- Renew the certificate with your CA or trigger auto-renewal manually (e.g.,
certbot renew --force-renewal).
- Deploy the new certificate to your web server or load balancer. Reload the server configuration so it picks up the new file.
- Verify with the TLS Inspector that the new certificate is being served and the
validTo date is in the future.
- Set up monitoring to alert at least 30 days before the next expiry. Tools like certbot have built-in timers, or you can use external certificate monitoring services.