Certificate expired: symptoms, cause, and the test that catches it

A TLS certificate or pinned certificate expires and connections fail.

Certificate expired is documented by 4 accepted public reports from 4 organisations, 4 of them published in the last 5 years.

Likelihood: medium (4 public reports in 5 years)
Impact: medium (4 of 4 reports: availability)

4 public reports · verified 2026-10-21

Symptoms

User-visible

Users opening the platform UI received certificate errors.[1]
Signals sent to the API domain between 17:56 and 19:01 UTC were not ingested and cannot be recovered.[1]
Repository operations over SSH and HTTP failed, and raw file access failed with them.[2]
LDAP authentication failed intermittently with an error about failing to establish a connection.[3]
Devices configured for the encrypted DNS gateway lost internet access.[4]

Monitoring-visible

A synthetic monitoring test raised a 30-day advance expiry alert that was not acted upon.[1]
Alerts from the monitoring platform had stopped reaching the incident management system, and the alert pipeline itself was not monitored.[1]
LDAP performance degradation was under investigation from 04:00 MDT.[3]
Customer reports came first, and troubleshooting began about 25 minutes after the old DNS gateway certificate expired.[4]

Root causes

stage: infra A certificate renewed on 22 May 2025 reached only part of the global cloud environment because the deployment process had an error. The old certificate then expired on 15 June 2025.[4]
stage: infra A shared SAN certificate covering the platform UI domain, the API domain and an internal domain relied on manual rotation. It reached its expiry date without a replacement because the advance warnings never reached a person who acted on them.[1]
stage: infra The automated job that renews an internal infrastructure TLS certificate failed to run its scheduled update. Dependent LDAP services then could not renew their own certificates and lost connections to the core database and security vault.[3]
stage: infra A TLS certificate used for internal service-to-service communication expired.[2]

Public examples

[1]Lucidworks, 2026-07-28. A manually renewed shared TLS certificate for the Lucidworks SaaS Platform domains expired without a replacement after the advance expiry alerts stopped reaching the responsible team, so the platform UI returned certificate errors and Beacon signal ingestion stopped for about 65 minutes. primary SaaS Platform User Interface and Signals Beacon Disruption
[2]GitHub, 2025-12-11. An expired TLS certificate used for internal service-to-service communication made all Git operations over SSH and HTTP, and raw file access, fail on GitHub for 64 minutes on 18 November 2025. primary GitHub Availability Report: November 2025
[3]JumpCloud, 2025-10-08. An internal TLS certificate expired after the automated renewal job failed to run, so dependent LDAP services could not renew their own certificates and some customers saw intermittent LDAP authentication failures. primary LDAP Degredation
[4]Jamf, 2025-06-16. An SSL certificate renewed in May 2025 was only partly distributed because the deployment process had an error, so when the old certificate expired on 15 June 2025 devices using Jamf SecureDNS lost internet access for 270 minutes. primary Jamf Security Cloud - secure DNS services are not working due to a wrong certificate

Test classes that catch it

Test class	Stage	Limitation	Basis
Synthetic monitoring	post-deploy	A probe of public domains does not reach internal service-to-service or LDAP backend certificates, and the one probe that did fire 30 days ahead sent its alert to a channel that nobody acted on.	cited in [1] [4]
Configuration and environment tests	post-deploy	An expiry date check on the certificate store reports the renewed certificate as valid even when the deployment reached only part of the cloud environment and some nodes still serve the old one.	by design analysis

Risk

Likelihood: medium (4 public reports in 5 years)
Impact: medium (4 of 4 reports: availability)

Counts behind the grades
Accepted public reports	4
Published in the last 5 years	4
Impact stated: availability	4

How the grades are computed

Pre-release checklist

PR-01List every certificate the service presents or trusts, including internal service-to-service and LDAP backend certificates, with its expiry date and renewal owner. config
PR-02After each renewal, fetch the certificate from every node and region behind the domain and confirm each one serves the new serial number. config
PR-03Alert when the last successful run of the scheduled certificate renewal job is older than its renewal interval. config
PR-04After a renewal, confirm every dependent service presents its own renewed certificate, and restart those that still present the old one. config
PR-05Probe every domain on a shared SAN certificate on a schedule and alert when fewer than 30 days remain before expiry. synthetic
PR-06Run a probe from inside the network against internal TLS endpoints and alert when fewer than 30 days remain before expiry. synthetic
PR-07Route certificate expiry alerts to a paged path that requires acknowledgment. config
PR-08Send a test certificate expiry alert through the paged path each week and confirm someone acknowledges it. synthetic
PR-09Send a heartbeat alert from the monitoring platform every hour and page when the incident management system does not receive it. synthetic

First 30 minutes

FM-01Fetch the certificate from the failing endpoint and read its expiry date and serial number to confirm the fault.
FM-02List every domain the same certificate covers, such as the UI, API and signal collection domains, and mark each as affected.
FM-03Skip an application rollback, because the expiry did not come from a release; decide instead between deploying an already renewed certificate and issuing a new one.
FM-04Deploy the replacement certificate to every load balancer and node, then restart services that did not pick it up.
FM-05Confirm dependent services, such as LDAP services that rely on the internal certificate, now present valid certificates of their own.
FM-06Post a status update that names the affected domains and the exact expiry time.
FM-07Tell customers whether data sent during the outage window was lost, and give the start and end times of that window.

Download the checklist

Pre-release checklist (Markdown)1.8 KB · v1.0.0
First 30 minutes checklist (Markdown)1.2 KB · v1.0.0

What catches this: catalogue entries

Listed because their own documentation or site names synthetic monitoring, configuration and environment tests on the verification date. Alphabetical. Not a recommendation.

Tools whose documentation names these test classes

Checkly synthetic source verified 2026-10-21
Datadog Synthetic Monitoring synthetic source verified 2026-10-21
Flipt config source verified 2026-10-21
Grafana Cloud Synthetic Monitoring synthetic source verified 2026-10-21
Grafana k6 synthetic source verified 2026-10-21
GrowthBook config source verified 2026-10-21
LaunchDarkly config source verified 2026-10-21
PostHog config source verified 2026-10-21
Postman synthetic source verified 2026-10-21
Unleash config source verified 2026-10-21
Uptime Kuma synthetic source verified 2026-10-21

Providers whose site names these test classes

No provider in the catalogue names this test class on its site.

Only on this page

Certificate expired starts in the infra stage in report [1], report [2], report [3] and report [4], not in application code. No application release triggered any of these failures. The trigger was a date passing on a certificate that was partly distributed [4], rotated by hand [1], left by a renewal job that did not run [3] or used only for internal service-to-service traffic [2].

Pre-merge and pre-deploy tests run against a release, so they never execute on the expiry date. Report [1] shows that the gap was the alert route rather than detection. A synthetic test raised a 30-day advance alert on 27 June 2026, and from 1 July 2026 alerts stopped reaching the incident management system. The status page entry opened at 18:19 UTC, 23 minutes after the shared certificate expired [1]. The follow-up in report [1] routes certificate expiry alerts to a paged path that requires acknowledgment.

OAuth callback URL not whitelisted A new domain or route is not registered with the identity provider.
Deep link broken after routing change Deep links or universal links open the wrong screen or nothing.
Dependency removed from registry A package or version is pulled from a registry and builds or deploys fail.
DNS change propagation outage A DNS or load balancer change sends traffic to the wrong target or nowhere.
Provider API change breaks contract A third-party API changes a field or behaviour and the integration fails.

Questions

What causes certificate expired?

The four reports name a partly distributed renewal [4], a manual rotation with unread alerts [1], a renewal job that did not run [3] and an internal service-to-service certificate [2]. All four causes sit in the infra stage.

What are the symptoms of certificate expired?

Users saw certificate errors on the platform UI, and signals sent during the window were lost [1]. Repository operations over SSH and HTTP failed for 64 minutes in report [2].

Why did tests not catch certificate expired?

None of the four failures came from a release, so pre-deploy tests had nothing to run against. A synthetic test did alert 30 days ahead, but the alert was not acted upon [1].

Which test class catches certificate expired, and what does it miss?

Synthetic monitoring carries the cited label from two reports [1][4]. A probe of public domains misses internal service-to-service certificates. Configuration and environment tests carry the by-design label.

Which public reports document certificate expired?

Four primary reports from four organisations document it, published between 2025-06-16 [4] and 2026-07-28 [1]. All four classify the impact as availability.

Should a team roll back or fix forward when certificate expired happens?

All four reports fixed forward by deploying or replacing the certificate. Report [3] ran the renewal script by hand and restarted services that did not pick up the new certificate. FM-03 records why an application rollback does not help.

Release Incident Playbook (2026). Certificate expired: symptoms, cause, and the test that catches it, content version 1.0.0. https://releasefailures.com/incidents/certificate-expired/. Accessed 2026-10-21.