Certificate expired: pre-release and first 30 minutes checklists

A TLS certificate or pinned certificate expires and connections fail.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

9 pre-release items · 7 first-30-minutes items · verified 2026-10-21

Pre-release checklist

PR-01List every certificate the service presents or trusts, including internal service-to-service and LDAP backend certificates, with its expiry date and renewal owner. config
PR-02After each renewal, fetch the certificate from every node and region behind the domain and confirm each one serves the new serial number. config
PR-03Alert when the last successful run of the scheduled certificate renewal job is older than its renewal interval. config
PR-04After a renewal, confirm every dependent service presents its own renewed certificate, and restart those that still present the old one. config
PR-05Probe every domain on a shared SAN certificate on a schedule and alert when fewer than 30 days remain before expiry. synthetic
PR-06Run a probe from inside the network against internal TLS endpoints and alert when fewer than 30 days remain before expiry. synthetic
PR-07Route certificate expiry alerts to a paged path that requires acknowledgment. config
PR-08Send a test certificate expiry alert through the paged path each week and confirm someone acknowledges it. synthetic
PR-09Send a heartbeat alert from the monitoring platform every hour and page when the incident management system does not receive it. synthetic

First 30 minutes

FM-01Fetch the certificate from the failing endpoint and read its expiry date and serial number to confirm the fault.
FM-02List every domain the same certificate covers, such as the UI, API and signal collection domains, and mark each as affected.
FM-03Skip an application rollback, because the expiry did not come from a release; decide instead between deploying an already renewed certificate and issuing a new one.
FM-04Deploy the replacement certificate to every load balancer and node, then restart services that did not pick it up.
FM-05Confirm dependent services, such as LDAP services that rely on the internal certificate, now present valid certificates of their own.
FM-06Post a status update that names the affected domains and the exact expiry time.
FM-07Tell customers whether data sent during the outage window was lost, and give the start and end times of that window.

Download the checklist

Pre-release checklist (Markdown)1.8 KB · v1.0.0
First 30 minutes checklist (Markdown)1.2 KB · v1.0.0

Only in this checklist

Every test class in this checklist also appears in at least one sibling checklist in the group; the item texts differ: List every certificate the service presents or trusts, including internal service-to-service and LDAP backend certificates, with its expiry date and renewal owner.

Questions

What should be checked before a release to prevent Certificate expired?

9 pre-release items, PR-01 to PR-09. PR-01: List every certificate the service presents or trusts, including internal service-to-service and LDAP backend certificates, with its expiry date and renewal owner.

Is there a rollback plan for Certificate expired?

The first-30-minutes checklist has 7 items. FM-01: Fetch the certificate from the failing endpoint and read its expiry date and serial number to confirm the fault.

What should a team do in the first 30 minutes after Certificate expired is detected?

The first-30-minutes checklist has 7 items. FM-01: Fetch the certificate from the failing endpoint and read its expiry date and serial number to confirm the fault.

Which configuration checks apply to Certificate expired?

PR-01: List every certificate the service presents or trusts, including internal service-to-service and LDAP backend certificates, with its expiry date and renewal owner. PR-02: After each renewal, fetch the certificate from every node and region behind the domain and confirm each one serves the new serial number. PR-03: Alert when the last successful run of the scheduled certificate renewal job is older than its renewal interval. PR-04: After a renewal, confirm every dependent service presents its own renewed certificate, and restart those that still present the old one. PR-07: Route certificate expiry alerts to a paged path that requires acknowledgment.

Is a Certificate expired checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: configuration and environment tests and synthetic monitoring.

Which pipeline stages does the Certificate expired checklist cover?

The pre-release items map to the pre-deploy and post-deploy stages.