Akamai SSL certificate expired

akamai ssl certificate expired on the edge hostname breaks every visitor whose browser talks to Akamai—even when your origin listener still holds a valid commercial certificate.

Akamai terminates TLS on the hostname your marketing site advertises, usually a branded CNAME under edgekey.net or your delegated edge hostname. Certificate Manager and CPS (Certificate Provisioning System) enrollments attach that leaf to the delivery property serving your customer-facing name.

Renewal tickets often stop at the origin load balancer while CPS still serves last year’s enrollment on the Akamai map. Network operations needs openssl against the public CNAME, property version, and enrollment status—not only the IIS or nginx PEM behind the origin.

This runbook walks certificate inventory in Akamai Control Center, external confirmation, CPS renewal or replacement enrollment, and activation so the property customers resolve in DNS presents future-dated material.

What to check

Separate the customer hostname (what openssl uses with SNI) from origin hostnames Akamai fetches. Browsers validate only the edge certificate. An expired edge breaks checkout and APIs even when CDN edge OK but origin certificate expired patterns run in reverse—here the edge is the failure.

Confirm which CPS enrollment or third-party upload backs the property. Managed DV/OV enrollments renew through Akamai workflows; customer-supplied certs expire on your calendar. SAN coverage must include every hostname on the property, including apex and www variants marketed in DNS.

Check property activation state. A renewed enrollment sitting in staging does not change live TLS until you push an activation the map honors. Capture serial number and notAfter from external openssl before opening CPS so you can prove change after publish.

Document who owns the authoritative DNS zone for each hostname on the property. CPS DV challenges and third-party renewals both stall when marketing delegates DNS to a registrar login nobody on-call can access. Export a hostname inventory from Akamai alongside your CMDB so acquisition-driven hostname sprawl does not hide a forgotten vanity domain on an old contract.

Step-by-step

Confirm live TLS on the customer CNAME

HOST=www.example.com
echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" 2>/dev/null \
  | openssl x509 -noout -dates -serial -subject -issuer

Compare issuer and subject to the enrollment you expect in Control Center. If DNS still points at an old property, you may read a different cert—verify the CNAME target in your registrar matches the active delivery configuration.

dig +short CNAME www.example.com

Inventory in Akamai Control Center

Open CDN → Properties and locate the configuration for the customer hostname. Under Property Hostnames, note hostnames bound to the property. Open Certificates (or Certificate Provisioning System) and match enrollments to those names.

For CPS-managed certificates, open the enrollment and read Validation, Certificate, and Change Management tabs. Expired or “Change Pending” states explain incidents even when origin ops renewed locally.

For Enhanced TLS customer-uploaded certs, download metadata or open the cert detail page and compare notAfter with your openssl capture.

Renew or replace the enrollment

CPS DV/OV: start renewal from the enrollment, complete domain validation Akamai emails or DNS tokens require, wait until CPS shows an issued certificate, then associate it with the property hostname if not automatic.

Third-party upload: obtain renewed PEM and key from your CA, upload via Certificate Manager, update the property hostname to reference the new slot, and schedule activation.

Use Akamai CLI where your organization standardizes automation:

akamai property list --contract CONTR --group GRP
akamai cps enrollment list --contract CONTR

Replace contract and group identifiers with values from your Akamai account; redact them in tickets.

Activate and purge as needed

Submit Activate on the property version that references the new certificate. Large estates use incremental activation windows—communicate to stakeholders before pushing globally.

If browsers still show old dates behind corporate proxies, test from an external VPS and mobile networks. Optional edge cache purge is unrelated to cert swap but helps when mixed content was cached during the incident.

Coordinate change windows with release management. Akamai activations during peak commerce hours are avoidable when openssl shows more than forty-eight hours of remaining validity. Still run a post-activation openssl sweep from at least two public resolvers to catch split-horizon DNS mistakes between corporate and public views.

Re-test origin if fetches fail after edge fix

Once edge notAfter is future-dated, confirm origin pulls succeed. If only dynamic routes fail, split checks per CDN edge OK but origin certificate expired guidance.

How to read the output

Openssl notAfter on the customer hostname is the contract with users. Serial should change after CPS issues new material and activation completes. Issuer on Akamai-managed enrollments typically reflects the Akamai or partner CA listed in CPS.

If subject covers a wildcard but marketing added a new hostname to the property without updating SANs, clients see name mismatch errors distinct from expiry—still fix enrollment coverage in CPS.

Control Center enrollment status Production with openssl still showing expired dates usually means DNS points at a different property, stale activation, or a secondary hostname not on the enrollment you renewed.

Common mistakes

Renewing only the origin while CPS enrollment lapses—the dominant akamai ssl certificate expired pattern during cloud migrations.

Editing DNS to point at the origin during an incident, then forgetting to restore the Akamai CNAME after fixing CPS—traffic bypasses the CDN and bypasses your monitoring of the edge.

Assuming Akamai auto-renews customer-uploaded commercial certs the same way as CPS-managed DV—uploaded certs need your procurement calendar.

Activating a staging property version that references test enrollments while production hostnames remain on the previous version.

Testing from inside Akamai corporate VPN split tunneling that resolves differently than public resolvers.

Skipping www and apex when openssl checks—both need enrollments or redirect rules with valid TLS on each hop.

Treating staging property hostnames as proof of production readiness without activating the production configuration customers resolve.

Ignoring mobile deep links that call api hostnames on separate properties under a different contract identifier—openssl each hostname in app release notes, not only the storefront www name.

When to use automation

Akamai properties multiply across brands and contracts; spreadsheet CPS dates drift from live maps after acquisitions. Monitor the live TLS certificate on every customer CNAME, not enrollment PDFs in email.

ssldays reads the certificate strangers receive (issuer, SANs, chain trust, expiry) and can alert at 30, 14, 7, and 1 days before notAfter. RDAP helps when registrar issues block validation records on apex domains. Email alerts ship on all plans; Slack and Discord webhooks are available on Starter and Pro. Free tier covers three domains with daily checks; Starter adds 25 hourly; Pro 100 hourly.

Run a one-shot check at /check, then register at /register for the hostnames your status page advertises. Pair edge watches with origin probes when you run split-horizon setups described in load balancer presenting an expired certificate runbooks for hybrid edges.