Security
SSL certificate expired: what to do before renewing blindly
When a certificate expires, the immediate goal is restoring a valid public TLS chain. The second goal is finding why renewal or deployment failed so the same outage does not recur at the next expiry.
Inspect the certificate the public server is actually presenting
Do not assume the file you renewed is the file the reverse proxy or web server uses. Check the public endpoint, hostname, issuer, serial, and expiry from outside the machine.
Review renewal logs and validation requirements
Automated certificate clients can fail because DNS or HTTP validation cannot reach the expected token, credentials expired, rate limits were hit, or the renewal job stopped running. Read the actual renewal result.
Reload services after successful deployment when required
Some services keep certificates in memory until configuration is reloaded. Confirm the process picked up the renewed certificate rather than leaving the old one active.
Add expiry monitoring independent of the renewal job
A cron job saying “success” is less useful than an external check of the certificate visitors receive. Alert far enough ahead of expiry to investigate safely.