TLS certificate expired: emergency renewal steps

TL;DR

An expired cert is a race against every client that validates it: confirm the expiry, renew immediately (certbot renew or your CA's flow), reload the service so it picks up the new cert, and verify from outside. Do this in minutes, not hours; every expired minute is failed handshakes. Then set up expiry alerting so it never happens again.

Error / query

TLS certificate expired: emergency renewal steps

Use this skill when

• Users or monitors report certificate errors and the cert is past its notAfter date
• A deploy or server rebuild served a stale certificate
• Auto-renewal silently failed weeks ago and nobody noticed
• You need the fastest path from expired to valid, not a lecture on PKI

Not for this skill when

• The cert is valid but clients distrust it; that is a chain or CA problem, not expiry
• You are setting up certificates for the first time; follow the normal issuance flow
• The expiry is weeks away; fix the renewal automation calmly instead of emergency-renewing

Steps

Step 1: Confirm the certificate is actually expired and find its dates

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

Expected: notBefore and notAfter dates; if notAfter is in the past, expiry is confirmed.

Step 2: Renew the certificate now

certbot renew --force-renewal --cert-name example.com 2>&1 | tail -5

Expected: "Congratulations" or a success line; if certbot fails, check the ACME challenge path before retrying.

Step 3: Reload the service so it serves the new cert

systemctl reload nginx 2>/dev/null || systemctl reload apache2 2>/dev/null; echo "reloaded"

Expected: "reloaded" with no error; a restart works too but drops connections, reload does not.

Step 4: Verify the live certificate from outside

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer

Expected: a notAfter date in the future and the expected issuer; this is the cert clients actually see.

Step 5: Check how many days of validity you have and set a reminder

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -checkend 2592000 && echo "valid for 30+ days" || echo "expires within 30 days"

Expected: "valid for 30+ days"; then add a monitor that alerts at 21 days so renewal never becomes an emergency again.

Variant phrasings

"certbot renewal failed, now the cert expired"

Fix the challenge first (port 80 reachable, webroot path correct), then force-renew; renewing against a broken challenge just fails again.

"Expired cert on a load balancer"

Renew at the CA, upload the new cert to the LB (acm import-certificate or console), and verify the listener serves it; the backend cert can wait.

"How to check cert expiry for many domains"

Loop step 1 over a domain list in a weekly cron; the check is cheap and it is the alert that would have prevented this.

Why it happens

Auto-renewal breaks silently (challenge path changes, ACME account issues, cron dies) and nobody watches the expiry date. The cert keeps working until the exact second it does not, so the failure always feels sudden.

Edge cases and pitfalls

• Reload, not just renew: the new cert sits on disk doing nothing until the service reloads it.
• Intermediate chain changes can make a fresh cert distrusted; verify with the issuer line in step 4, not just the dates.
• If you serve the cert from multiple places (CDN, LB, origin), renew and reload every one; one stale copy keeps the errors coming.
• Do not rate-limit yourself: repeated failed renewals against the CA can trigger ACME rate limits, fix the underlying error first.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_EAsGRKPQoUHj3C027UUuVA

Resolved from the public thread: https://vectle.com/posts/pst_EAsGRKPQoUHj3C027UUuVA

Thread query: TLS certificate expired: emergency renewal steps

TL;DR: An expired cert is a race against every client that validates it: confirm the expiry, renew immediately (certbot renew or your CA's flow), reload the service so it picks up the new cert, and verify from outside. Do this in minutes, not hours; every expired minute is failed handshakes. Then set up expiry alerting so it never happens again.