The Certificate That Expired

Step 1 — Understand the symptoms

Certificate expiry causes a total, hard failure rather than a degraded one because TLS handshake validation happens before any application logic runs — a browser or client that can't validate the certificate refuses to send the actual request at all. That's why the application's own logs and health checks show nothing wrong: from its perspective, no requests are arriving to fail. The break is entirely at the edge, between the client and the point where TLS is terminated.

Step 2 — Identify the likely bottleneck

This wasn't caused by a bug — it was caused by an absence: no automated renewal, and no monitoring that would have surfaced the approaching expiry date as a problem before it became an outage. A certificate provisioned once and left alone will always eventually expire; the actual root cause here is a process gap, not a technical one, which matters because it changes what "fixing" this incident actually requires.

Step 3 — Investigation

• Confirm the exact expiry timestamp and renew immediately — this restores service and is the first priority, separate from the process fix.
• Check whether this certificate was meant to auto-renew and didn't, or whether it was always a manual process — a broken automation is a different fix than a manual process that was simply forgotten.
• Check for other certificates in the environment with similarly no renewal automation — if this one slipped through, others provisioned the same way are worth auditing before they cause the same outage independently.
• Check what monitoring exists (or doesn't) for certificate expiry — most environments have no default alerting on this, since a certificate "working" gives no signal that it's approaching its end date.
• Review who owned certificate renewal and whether that ownership was clear, documented, and actually assigned to someone's regular responsibilities — an unowned recurring task is exactly the kind of thing that gets missed.

Step 4 — Recommended action

Beyond the immediate renewal, this calls for automated renewal wherever the platform supports it — most modern certificate authorities and cloud load balancers support automatic renewal well before expiry, removing the human-memory dependency entirely. Where automation genuinely isn't possible, add explicit expiry monitoring that alerts 30 and 14 and 7 days out, escalating — not a single alert on the day of expiry, which leaves no time to react, but a graduated warning that gives whoever owns it real lead time.

This is also worth treating as a small platform-wide audit, not just a one-certificate fix — if this certificate had no renewal automation, it's worth checking whether that's true of every certificate in the environment, since the same gap likely exists in more than one place.

Step 5 — Engineering lesson

An expired certificate isn't a technical failure in the usual sense — nothing broke, nothing crashed, the code did exactly what it was supposed to do. It's a process failure: a recurring maintenance task with no automation and no monitoring, waiting for the one day someone doesn't remember. The fix that actually prevents a repeat isn't "renew the certificate" — it's making sure the next expiry date, whenever it is, can't quietly arrive unnoticed again.