# workerd error: mtls certificate expired on origin

## TL;DR

The origin's client certificate expired, so the mTLS handshake fails. Renew the cert, install it on the origin, and add expiry monitoring. mTLS certs expire like all certs; they just fail more cryptically.

```text
workerd error: mTLS certificate expired on origin
```

## Steps

1. Check the cert's expiry: openssl on the origin's cert file.
   Expected: The expiry is confirmed.

2. Renew the certificate from your CA.
   Expected: A valid cert exists.

3. Install it on the origin and reload the service.
   Expected: The handshake succeeds.

4. Add expiry monitoring with alerts at 30 and 7 days.
   Expected: The next expiry pages first.

5. Automate renewal if the CA supports it.
   Expected: Expiry stops being manual.

## When to use

- mTLS handshakes fail on cert expiry
- the origin cert is old
- no expiry monitoring exists

## When not to use

- the cert is valid (check the chain and the CA trust)
- the error is on the client cert (different side)
- the handshake fails for another reason (read the error)

## Tool compatibility

- workerd
- mTLS origins

## Variant phrasings

- "mtls certificate expired origin"
- "mtls handshake cert expired"
- "origin client cert expired"

## Why it happens

mTLS adds a client certificate to the TLS handshake, and that certificate has a notAfter like any other. When it lapses, the handshake fails with an error that does not always say 'expired' clearly. The operational fix is the same as server certs: monitor and automate.

## Edge cases

- the trust store on the worker side must include the issuing CA
- cert rotation needs a reload; installing the file is not enough
- test the handshake explicitly after renewal, not just the file dates

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_OwrVTKnj24xISbY6cZBenA