criticalFoundationSymptom-first#tls#certificate#expired#openssl#x509

TLS certificate expired -- service unreachable for TLS clients

curl: (60) SSL certificate problem: certificate has expired

Likely source:availabilitysecurity

Focused incident mode — strips away everything but this runbook.

Symptoms

  • curl: (60) SSL certificate problem: certificate has expired
  • Browser shows ERR_CERT_DATE_INVALID
  • openssl s_client shows 'certificate has expired' in the verify error output

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Certificate expiry date

    echo | openssl s_client -connect <HOST>:<PORT> 2>/dev/null | openssl x509 -noout -dates

  • Full certificate details

    openssl s_client -connect <HOST>:<PORT> 2>/dev/null | openssl x509 -noout -text | head -30

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • notAfter date is in the past
  • No recent cert-manager or ACME renewal events

Confirm before fixing

echo | openssl s_client -connect <HOST>:<PORT> 2>/dev/null | openssl x509 -noout -dates
READ

Confirm the expiry date

Fix

certbot renew --cert-name <domain> && systemctl reload nginx
CHANGE

Renew the certificate and reload the web server

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
echo | openssl s_client -connect <HOST>:<PORT> 2>/dev/null | openssl x509 -noout -dates
READ

Check the expiry date

2
certbot renew --cert-name <domain>
CHANGE

Renew the certificate

3
systemctl reload nginx
CHANGE

Reload the web server to pick up the new certificate

4
echo | openssl s_client -connect <HOST>:<PORT> 2>/dev/null | openssl x509 -noout -dates
READ

Verify the new certificate expiry

Prevention

  • Use cert-manager with automatic renewal (Let's Encrypt ACME) for all TLS certificates.
  • Alert when certificates are within 14 days of expiry.
  • Monitor cert-manager Certificate resources for Failed or Unknown conditions.
  • Set up a backup manual renewal process for critical certificates.

Related runbooks

Same stack, same failure family — worth a skim.

TLS certificate chain incomplete — intermediate missingmedium

openssl s_client shows 'unable to get local issuer certificate'

TLS & PKIIntermediate2 causes
Open runbook
TLS hostname mismatch — certificate doesn't cover the namehigh

'SSL: certificate subject does not match hostname' in clients

TLS & PKIFoundation2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.