TLS Certificate Expiry Incidents

Detect expiring certificates before they cause outages and automate renewal pipelines.

Overview

Overview

TLS certificate expiry is one of the most preventable causes of production outages, yet it regularly brings down major services. The pattern is consistent: a certificate is issued, monitoring is set up (or not), attention drifts, and the certificate expires.

What expiry looks like to each client

  • Web browsers — ERR_CERT_DATE_INVALID or a security warning page; users blocked by default
  • HTTP clients in code (curl, requests, the AWS SDK) — Certificate validation exceptions; the call fails
  • API gateways and load balancers that verify upstream certs — Drop backend connections
  • HTTPS health checks — Fail and trigger automatic recovery, which does nothing because every instance has the same certificate

> [!WARNING] Auto-recovery cannot help: replacing instances does not replace an expired certificate.

ACM auto-renewal and its gap

ACM renews certificates it manages automatically, 60 days before expiry, when they are used with supported services (ALB, CloudFront, API Gateway, Elastic Beanstalk). The renewal is silent and needs no intervention.

> [!IMPORTANT] Expiry incidents in ACM environments happen almost exclusively with imported certificates.

Detection checks

  • ACM DaysToExpiry CloudWatch metric — Days left for every managed and imported certificate; alarm at 45 days (warning) and 14 days (critical)
  • AWS Config rule acm-certificate-expiration-check — Flags certificates inside a configurable threshold
  • Cron job running openssl s_client per hostname — Expiry of non-ACM certificates (EC2, on-premises, containers)
  • Third-party monitoring service — External view of every public endpoint
  • Is the certbot cron or systemd timer still active? — Whether Let's Encrypt renewal still runs

Let's Encrypt and ACME

The 90-day certificate lifetime is intentional: it forces automation. Certbot renews from a cron job or systemd timer.

> [!WARNING] The common failure: the cron job ran for months, then the server was replaced or rebooted and the job did not survive the migration.

Emergency response

  • ACM — Import a new certificate (under a minute) and associate it with the ALB or CloudFront distribution
  • Non-ACM — Issue a new certificate with certbot certonly, update the service configuration, reload the service

> [!NOTE] Full recovery, including detection, typically takes 15 to 30 minutes.

Key concepts

ACM Managed Certificate
A TLS certificate issued and managed by AWS Certificate Manager. Auto-renews 60 days before expiry when used with ALB, CloudFront, or API Gateway. Does not auto-renew for imported certificates.
DaysToExpiry
CloudWatch metric published by ACM for each certificate, showing days remaining until expiry. Use it to create alarms at 45-day warning and 14-day critical thresholds.
Certificate Import
Uploading a certificate issued outside ACM into ACM for use with ACM-compatible services. Imported certificates do not auto-renew and must be manually replaced before expiry.
ACME Protocol
The protocol used by Let's Encrypt and other CAs to automate certificate issuance and renewal. Certbot is the standard ACME client that handles DNS or HTTP challenges to prove domain ownership.
Certificate Pinning
A practice where clients hard-code the expected certificate or public key. When certificates are rotated, pinned clients break until updated — makes emergency certificate replacement harder.

When to use it

  • Building a certificate lifecycle monitoring system for a fleet of services
  • Explaining TLS certificate management and ACM auto-renewal in infrastructure design interviews
  • Diagnosing SSL handshake errors that users or health checks are reporting

Interview questions

  • Users are reporting SSL errors on your production site. The ALB and CloudFront use ACM certificates. How do you quickly diagnose whether this is a certificate expiry and what do you do?

Sign up free to read the full topic

More Troubleshooting topics

Start free on Cariara · Coding problems · System design studio