# Certificate expired: first 30 minutes checklist

Source: https://releasefailures.com/incidents/certificate-expired/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A TLS certificate or pinned certificate expires and connections fail.
- [ ] FM-01 Fetch the certificate from the failing endpoint and read its expiry date and serial number to confirm the fault.
- [ ] FM-02 List every domain the same certificate covers, such as the UI, API and signal collection domains, and mark each as affected.
- [ ] FM-03 Skip an application rollback, because the expiry did not come from a release; decide instead between deploying an already renewed certificate and issuing a new one.
- [ ] FM-04 Deploy the replacement certificate to every load balancer and node, then restart services that did not pick it up.
- [ ] FM-05 Confirm dependent services, such as LDAP services that rely on the internal certificate, now present valid certificates of their own.
- [ ] FM-06 Post a status update that names the affected domains and the exact expiry time.
- [ ] FM-07 Tell customers whether data sent during the outage window was lost, and give the start and end times of that window.