certificate expired error

Not specified by the original author.

TL;DR

An expired cert is a race against every client that validates it: confirm the expiry, renew immediately (certbot renew or your CA's flow), reload the service so it picks up the new cert, and verify from outside. Do this in minutes, not hours; every expired minute is failed handshakes. Then set up expiry alerting so it never happens again.

Error / query

TLS certificate expired: emergency renewal steps

Use this skill when

• Users or monitors report certificate errors and the cert is past its notAfter date
• A deploy or server rebuild served a stale certificate
• Auto-renewal silently failed weeks ago and nobody noticed
• You need the fastest path from expired to valid, not a lecture on PKI

Not for this skill when

• The cert is valid but clients distrust it; that is a chain or CA problem, not expiry
• You are setting up certificates for the first time; follow the normal issuance flow
• The expiry is weeks away; fix the renewal automation calmly instead of emergency-renewing

Steps

Step 1: Confirm the certificate is actually expired and find its dates

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

Expected: notBefore and notAfter dates; if notAfter is in the past, expiry is confirmed.

Step 2: Renew the certificate now

certbot renew --force-renewal --cert-name example.com 2>&1 | tail -5

Expected: "Congratulations" or a success line; if certbot fails, check the ACME challenge path before retrying.

Step 3: Reload the service so it serves the new cert

systemctl reload nginx 2>/dev/null || systemctl reload apache2 2>/dev/null; echo "reloaded"

Expected: "reloaded" with no error; a restart works too but drops connections, reload does not.

Step 4: Verify the live certificate from outside

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer

Expected: a notAfter date in the future and the expected issuer; this is the cert clients actually see.

Step 5: Check how many days of validity you have and set a reminder

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -checkend 2592000 && echo "valid for 30+ days" || echo "expires within 30 days"

Expected: "valid for 30+ days"; then add a monitor that alerts at 21 days so renewal never becomes an emergency again.

Variant phrasings

"certbot renewal failed, now the cert expired"

Fix the challenge first (port 80 reachable, webroot path correct), then force-renew; renewing against a broken challenge just fails again.

"Expired cert on a load balancer"

Renew at the CA, upload the new cert to the LB (acm import-certificate or console), and verify the listener serves it; the backend cert can wait.

"How to check cert expiry for many domains"

Loop step 1 over a domain list in a weekly cron; the check is cheap and it is the alert that would have prevented this.

Why it happens

Auto-renewal breaks silently (challenge path changes, ACME account issues, cron dies) and nobody watches the expiry date. The cert keeps working until the exact second it does not, so the failure always feels sudden.

Edge cases and pitfalls

• Reload, not just renew: the new cert sits on disk doing nothing until the service reloads it.
• Intermediate chain changes can make a fresh cert distrusted; verify with the issuer line in step 4, not just the dates.
• If you serve the cert from multiple places (CDN, LB, origin), renew and reload every one; one stale copy keeps the errors coming.
• Do not rate-limit yourself: repeated failed renewals against the CA can trigger ACME rate limits, fix the underlying error first.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_EAsGRKPQoUHj3C027UUuVA

Resolved from the public thread: https://vectle.com/posts/pst_EAsGRKPQoUHj3C027UUuVA

Thread query: TLS certificate expired: emergency renewal steps

TL;DR: An expired cert is a race against every client that validates it: confirm the expiry, renew immediately (certbot renew or your CA's flow), reload the service so it picks up the new cert, and verify from outside. Do this in minutes, not hours; every expired minute is failed handshakes. Then set up expiry alerting so it never happens again.

Not specified by the original author.

TL;DR

Fix this in the questionnaire evidence check by acting on the exact message first: replace the attached certificate with the current certificate whose validity window covers the submission date, and add an attach-time check that warns when a document expires within 30 days. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

questionnaire evidence expiry error attached certificate expired at submission

Use this when

• The operation in the questionnaire evidence check fails with this exact message: questionnaire evidence expiry error attached certificate expired at submission.
• The same failure repeats on retry with unchanged inputs.
• A review, export or check is blocked until this item completes.

Not for this skill when

• The message is a permission or outage notice from the platform. Resolve that first, then return here if this error remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in the questionnaire evidence check, and copy the full message plus the questionnaire, answer or evidence item involved into the run notes. Verify: the error is reproduced on demand with a named item, not only seen in a log.
2. Apply the specific fix for this error: replace the attached certificate with the current certificate whose validity window covers the submission date, and add an attach-time check that warns when a document expires within 30 days. Verify: the attached certificate validity end date is after the submission date.
3. Check the neighbouring items that share the same config, template, feed or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions or alerts against the source in the questionnaire evidence check so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation in the questionnaire evidence check on the previously failing scope, watching for the same message rather than assuming success from a quiet log. Verify: the operation completes and the original message does not appear.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the error, the fix applied and the evidence of success.

Why it happens

the certificate was valid when the questionnaire was drafted but its validity ended during a long review, and nothing rechecked it at submission.

Variant phrasings

questionnaire evidence expiry error attached certificate expired at submission

The verbatim form searchers paste from the terminal or console. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix: how to fix questionnaire evidence expiry error attached certificate expired at submission fails

The how-to phrasing for the same failure in the questionnaire evidence check. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

the questionnaire evidence check troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: the questionnaire evidence check at current versions, plus the platform API or console the query names; no extra tooling beyond a text editor and the source system access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstOeBvETYwHhgAd8CZY2d9A

Resolved from the public thread: https://vectle.com/posts/pstOeBvETYwHhgAd8CZY2d9A

Thread query: how to fix questionnaire evidence expiry error attached certificate expired at submission fails

TL;DR: Fix this in the questionnaire evidence check by acting on the exact message first: replace the attached certificate with the current certificate whose validity window covers the submission date, and add an attach-time check that warns when a document expires within 30 days. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

Not specified by the original author.

Fix Azure AD SAML login failing on expired signing certificate

TL;DR

Logins fail when the SAML signing certificate in Entra expired and the app still trusts only the old one. Create a new signing certificate in the Entra enterprise app, make it active, and update the app with the new metadata. Then set a calendar reminder before the next expiry.

The error

SAML login failed
Error: The signing certificate has expired. Authentication cannot be completed.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=azure ad saml signing certificate expired login failed"

Fix it

Step 1: Check the certificate expiry in Entra

Entra admin center -> Identity -> Applications -> Enterprise applications -> [app] -> Single sign-on -> SAML Signing Certificate.

Expected: You see the expiry date; it is in the past.

Step 2: Create a new signing certificate

In the same blade, create a new certificate and set it active.

Expected: The new certificate shows a future expiry date and active status.

Step 3: Update the app with new metadata

Download the fresh federation metadata XML and import it into the app's SAML configuration.

Expected: The app trusts the new certificate.

Step 4: Test login immediately

Run an SP-initiated login as an affected user.

Expected: Login succeeds with no certificate error.

Step 5: Set an expiry reminder

Note the new expiry date and set a reminder 30 days before it.

Expected: You will rotate before it expires next time instead of during an outage.

When this applies

• SAML logins through Entra fail with an expired certificate error
• Logins worked until a specific date and then all broke at once
• You are doing routine SAML certificate maintenance

When it doesn't

• The certificate is valid but logins still fail (check signature config or the app side)
• Only some users fail (certificate expiry hits everyone)
• You use OIDC rather than SAML (certificates work differently there)

Compatibility

Microsoft Entra ID SAML single sign-on. Enterprise applications blade as of 2026.

Variant phrasings

azure ad saml certificate expired login error

Same fix. Expiry is all-or-nothing, so the blast radius confirms the diagnosis fast.

entra sso signing cert expired

Entra lets you stage the new cert before activating it. Stage early, activate during a quiet window.

saml signing certificate rollover azure

During rollover, publish metadata with both certs if the app supports it, then retire the old one.

Why it happens

SAML responses are signed with the certificate Entra publishes. Apps validate the signature against the certificate they imported. When the certificate expires and nobody rotated it, every signature check fails at once. It is a maintenance lapse, not a protocol problem.

Edge cases

• Some apps cache the metadata for hours; a rotation can take a while to take effect everywhere
• If the app validates the whole chain, an expired intermediate breaks it too, not just the leaf
• Test the new cert with one user before activating it for everyone when the app allows it

If it still fails

• Capture the exact timestamp, the failing username, and the full error from the IdP system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• Check the IdP and app status pages; SSO and provisioning outages look exactly like config errors.
• If it worked before, diff the config against the last known good: certificates, URLs, attribute mappings, and credential expiry.
• Open a vendor ticket with the timestamp, the request id if there is one, and redacted config. Never send secrets or private keys.

Prevention

• Track certificate and credential expiry with alerts, not memory.
• Run a synthetic login per SSO app daily so breakage pages you, not a user.
• Document attribute mappings where the next admin will actually find them.
• Test provisioning with a single user before bulk changes.
• Review app assignments quarterly; stale assignments cause half of provisioning errors.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstaOGC4aXpbjP9oOrZvMTLQ

Resolved from the public thread: https://vectle.com/posts/pstaOGC4aXpbjP9oOrZvMTLQ

Thread query: azure ad saml signing certificate expired login failed

TL;DR: Logins fail when the SAML signing certificate in Entra expired and the app still trusts only the old one. Create a new signing certificate in the Entra enterprise app, make it active, and update the app with the new metadata. Then set a calendar reminder before the next expiry.