Expired Certificate in Production: An Incident Response Runbook
Introduction
When a certificate expires in production, do the following: Look at the expiry date and set up an incident leader. Determine which certificate is correct and who owns it, get a new certificate, deploy to all locations, and test. Next, correct the cause so that it will not happen again. This run-book will take you through each step.
An expired certificate can render a website, API, or payment page unusable in just minutes. Customers are frightened by the security warning, and they go away. This guide provides your team with a run-book, a post-incident checklist, and a plan to avoid another incident. Keep it handy. Let’s get started.
Why Certificates Expire in Production
Difficult problems are a rare cause of outages. They are errors of simple misses. Even the large establishments have their share of slip-ups. In February of 2020, many users were unable to access Microsoft Teams because of an expired certificate. The typical culprits are easily identified:
- There is no complete list of certificates.
- There is no owner for the certificate.
- Alerts go to someone who has left the company
- A new certificate but not installed.
- Short life spans that outpace manual tracking.
That’s the last cause that is expanding. The length of time for public TLS certificates has been cut to 200 days. That drops to 100 days in March 2027 and 47 days in March 2029.
Expired Certificate Incident Response Runbook: Step by Step
Do these seven steps sequentially. Before an incident, designate a specific individual to each one of them.
Step 1: Verify That the Certificate Has Expired
Don’t guess. See the error in a browser or in a certificate checker and read the expiry date. Ensure that it is a certificate issue and not a DNS or load balancer issue. Record the names and endpoints that are impacted.
Step 2: Declare the Incident and Assign Roles
Identify one incident lead. Have an individual to resolve the issue, an individual to communicate, and an individual to record actions. Open 1 channel for incident. Explain support and leadership. What’s down? Don’t work in the dark.
Step 3: Find the Certificate and Its Owner
Look in your inventory for the expired certificate. Determine the owner and location of it. No inventory? Look at the CA account, load balancers, CDN, and certificate stores. Our guide on how to discover all certificates throughout your enterprise demonstrates how to construct one.
Step 4: Get a New Certificate
Ask your certificate authority (CA) to renew your certificate. Use ACME if your CA supports it, it’s faster. You might have to run a domain validation check first. If you believe that the private key has been compromised, generate a new private key and obtain a new certificate. Avoid using the same key as before. If validation becomes problematic, go to your CA’s support.
Step 5: Install It Everywhere
A certificate will not be of any use until it is used by servers. Install on all systems that had the old one installed. Check load balancers, CDNs, API gateways, mail servers, and backup nodes. Attach all the intermediate certificates. Reload services as necessary.
Step 6: Test and Verify
Test on an external network. Verify all affected names and endpoints. Check the new expiration date and the entire chain. Use some browsers and clients, such as mobile applications and API clients. Monitor errors until they are back to normal.
Step 7: Communicate and Close
Communicate to customers and teams that service is restored. Note the dates: the date of the certificate’s expiration, the date you noticed the problem, and the date you resolved it. Then arrange for a post-incident review in a few days.
Post-Incident Checklist
Even after the outage is repaired, the job is not done. Use the following questions during your review:
- Why was the alert not triggered or followed up?
- Who was the owner of this certificate and did they know?
- Did the certificate fall out of the inventory?
- Did it not renew, or did it not install?
- How many other certificates are there that have the same risk?
Turn each response into a task and then add an owner and due date.
How to prevent an expired certificate in production?
The best prevention is to not have to use this run-book. First steps can be taken:
- Build one inventory. Manage all certificates in one place.
- Designate an owner and back-up. Update owners when people change jobs.
- Set early alerts. Use 90, 60, 30, and 7 days.
- Automate the safe renewals first. Good starting points are the regular website certificates.
- Test every renewal. Verify if the new certificate is being used.
- Always check the setup every quarter. Tighten up the gaps before they get bigger!
If you’re selecting tools, consult our handy checklist for comparing enterprise certificate lifecycle management tools. Furthermore, teams in India can also see the top certificate lifecycle management solutions in India 2026.
Expired Certificate in Production? Prevent a Repeat With AppleShine Tech
In a crisis, a run-book is helpful. Prevention means that you won’t need to go in one. This is where AppleShine Tech can be of service.
Our certificate lifecycle management solution is a part of a comprehensive certificate lifecycle management service. It encompasses discovery, inventory, issuance, deployment, monitoring, renewal, revocation, and retirement.
Your service will include:
- One perspective of internal and external certificates, clearly showing who owns them.
- Support for public CAs and private PKI
- Automating renewals using ACME, SCEP, or EST (if applicable).
- Alerts, Approval History, and Audit Logs for Review.
We integrate with your current PKI and certificate authorities, without the need to reinvent the wheel.
Conclusion
An expired certificate in production is stressful but can be remedied. Check expiration, designate roles, determine owner, renew, install to all locations, and test. Then have a review to prevent the same miss from happening again.
The length of certificates is being reduced, and manual tracking will fail more frequently. Create a stock list, assign owners, and set up automatic safe renewals. The certificate lifecycle management connects these actions and ensures that you don’t get caught with expired certificates.
Ready to stop expired certificates before they cause outages? Talk to AppleShine Tech about a review of your certificate setup, and share your questions in the comments below.
FAQs About Expired Certificates in Production
What should I do first when a certificate expires in production?
Confirm the certificate is the cause, then name an incident lead. Next, find the certificate’s owner and request a new one from your CA.
How long does it take to fix an expired certificate?
It can take minutes with automation or hours if validation or approvals are slow. A named owner and a ready run-book save the most time.
Can I keep using an expired certificate for now?
No. Browsers and clients block or warn on expired certificates. Telling users to click past the warning is unsafe, so replace the certificate.
How do I prevent an expired certificate in production?
Keep one inventory, name an owner for each certificate, set early alerts, and automate safe renewals. Test every renewal and review your setup each quarter.
Does certificate lifecycle management prevent expired certificate outages?
Yes, it helps a lot. Certificate lifecycle management finds every certificate, sends alerts, renews on time, and keeps records for reviews.