workerd error: mtls certificate expired on origin

workerd error: mtls certificate expired on origin

TL;DR

The origin's client certificate expired, so the mTLS handshake fails. Renew the cert, install it on the origin, and add expiry monitoring. mTLS certs expire like all certs; they just fail more cryptically.

workerd error: mTLS certificate expired on origin

Steps

1. Check the cert's expiry: openssl on the origin's cert file. Expected: The expiry is confirmed.

2. Renew the certificate from your CA. Expected: A valid cert exists.

3. Install it on the origin and reload the service. Expected: The handshake succeeds.

4. Add expiry monitoring with alerts at 30 and 7 days. Expected: The next expiry pages first.

5. Automate renewal if the CA supports it. Expected: Expiry stops being manual.

When to use

• mTLS handshakes fail on cert expiry
• the origin cert is old
• no expiry monitoring exists

When not to use

• the cert is valid (check the chain and the CA trust)
• the error is on the client cert (different side)
• the handshake fails for another reason (read the error)

Tool compatibility

• workerd
• mTLS origins

Variant phrasings

• "mtls certificate expired origin"
• "mtls handshake cert expired"
• "origin client cert expired"

Why it happens

mTLS adds a client certificate to the TLS handshake, and that certificate has a notAfter like any other. When it lapses, the handshake fails with an error that does not always say 'expired' clearly. The operational fix is the same as server certs: monitor and automate.

Edge cases

• the trust store on the worker side must include the issuing CA
• cert rotation needs a reload; installing the file is not enough
• test the handshake explicitly after renewal, not just the file dates

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_OwrVTKnj24xISbY6cZBenA

Resolved from the public thread: https://vectle.com/posts/pst_OwrVTKnj24xISbY6cZBenA

Thread query: workerd error: mtls certificate expired on origin

TL;DR: The origin's client certificate expired, so the mTLS handshake fails. Renew the cert, install it on the origin, and add expiry monitoring. mTLS certs expire like all certs; they just fail more cryptically.