CDN edge OK but origin certificate expired

A healthy CDN certificate can hide an expired origin certificate that still breaks API calls, cache fills, and health checks.

Visitors see a green padlock because the edge PoP presents a valid managed certificate. Meanwhile origin pulls, authenticated APIs, and WebSocket upgrades may fail when the upstream certificate is past notAfter.

Operators sometimes renew only the orange-cloud edge and forget the grey-cloud origin listeners. Split your checks: test the customer hostname at the edge, then test the origin hostname or bypass header your platform documents.

First response

Visitors see a valid CDN certificate while origin TLS is expired, breaking fetches and APIs. Split edge vs origin checks and renew the certificate the origin presents.

Search interest in cloudflare ssl expired origin rises when the leaf notAfter on the hostname customers type is already in the past. Clients cannot rewrite server certificate dates; they only accept chains that pass PKIX checks at handshake time.

For CDN edge OK but origin certificate expired, prove the failure from outside your office VPN before you change application code, purge caches, or ask end users to reboot. Capture the broken serial number and notAfter, renew on the listener that actually terminates that name, reload every node in the path, then re-run the same OpenSSL and browser checks that opened the incident.

CDN incidents feel paradoxical because the padlock shows a fresh edge issuer while APIs stall or storefront fragments return 502 and 525 responses. Support hears that the website works in a screenshot but checkout JSON fails in production monitors. That pattern means browsers never saw the broken certificate; the edge did when opening the origin fetch. Communicate to leadership that two TLS handshakes exist and only one may be renewed. Until origin notAfter is future-dated, partial outages persist no matter how healthy the edge Universal SSL appears.

See also Android SSL certificate expired errors and Certificate chain incomplete in the browser.

What this error means

CDNs terminate TLS for browsers but often open a second TLS session to your origin. That back-end handshake validates the origin’s certificate independently. When it expires, edge HTML may still cache while dynamic routes return 5xx or empty responses.

Flexible or “CDN-only” SSL modes can mask how long the origin has been broken. Full (strict) modes refuse to fetch from an expired origin, which surfaces the issue earlier—but only if you monitor origin TLS directly.

The fix is not at the CDN’s public certificate slot but at the origin listener: renew the cert on the machine or tunnel the CDN uses, then verify fetches succeed with strict validation.

When a CDN terminates client TLS, visitors validate only the edge certificate. A separate origin connection validates the certificate on your load balancer, tunnel hostname, or direct IP as configured in the provider. If that origin leaf expired, the CDN may still cache HTML while dynamic routes fail, producing confusing split symptoms. Cloudflare ssl expired origin style failures are expiry on the back-end handshake, not necessarily the certificate users click in Chrome devtools.

This pattern is not fixed by purging browser cache alone when the edge cert is still valid. It is not the same as an expired edge Universal SSL slot when openssl to the origin name still shows old notAfter. It is not a client DNS failure when only uncached API paths break. It is not resolved by renewing only the CDN-managed edge cert if strict origin pull requires a valid server cert at the origin. It is not evidence that the CDN is down when static pages are cached with a healthy edge chain.

Common causes

These patterns appear often during cloudflare ssl expired origin incidents. They are not exhaustive, but they explain why renewal looked finished internally while strangers still received expired material.

Origin certificates on the application load balancer expired while operations tracked only the CDN dashboard green indicators. Managed origin certificate auto-renewal was disabled and nobody uploaded the new PEM to the pull configuration. Certbot renewed on the VM but health checks used plain HTTP and never alerted on backend TLS dates. PagerDuty stayed quiet because external probes hit the edge name instead of the origin pull hostname.

Full strict SSL mode requires a publicly trusted origin cert, but teams left an expired Let us Encrypt cert on the origin while flexible mode masked the issue temporarily. Multiple origins in a pool mixed renewed and expired targets behind the same hostname. Kubernetes ingress used cert-manager on the cluster edge only, while the origin Service still presented an old file mount.

Workers or serverless middleware called origin URLs directly, bypassing the CDN and hitting expired TLS on an internal hostname that sync jobs use. Staging origin hostnames were renewed but production origin DNS still pointed at the old listener certificate. Grafana charts monitored edge expiry only, so origin notAfter drifted past with no page. Incident retros confused edge renewal success with origin handshake health until OpenSSL compared both layers side by side.

Confirm from the outside

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Run once against the public site name, then against the origin host your provider connects to. Different notAfter values prove split expiry between edge and origin.

How to read the output

First openssl s_client to the public customer hostname and note edge notAfter and issuer, often the CDN vendor. Second, from a bastion allowed to reach the origin, openssl s_client -connect origin.internal:443 -servername origin.internal with the name the CDN uses for pull. If the second notAfter is in the past while the first is future, you have confirmed CDN edge OK but origin expired. Capture both transcripts in the incident record because vendors will ask for them.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

curl the public URL, then curl the origin URL from a bastion allowed to reach it. Compare TLS errors; edge success with origin failure is the hallmark of this incident class.

Browser spot-check

Browsers only see the edge certificate in the padlock viewer. Use provider dashboards plus origin OpenSSL to catch backend expiry browsers cannot display.

Fix checklist

Work this list in order for cdn edge ok but origin certificate expired. Each step should produce evidence (command output, timestamps, serial numbers) you can paste into the incident ticket.

1. Document which hostname the CDN uses for origin TLS (direct IP, CNAME, or tunnel).
2. Compare notAfter on edge vs origin with OpenSSL from external and internal vantage points.
3. Renew the certificate on the origin load balancer or web server, not only the CDN slot.
4. Upload or sync the new origin cert if the platform requires manual binding.
5. Purge or bypass cache for failing dynamic paths after origin fix.
6. Enable strict origin validation in the CDN if it was relaxed during debugging.
7. Run synthetic checks that hit uncached API routes through the CDN.
8. Monitor both edge and origin certificates on independent schedules.

Roll out and verify

Renew the certificate installed where the origin TLS handshake occurs, matching the SAN the CDN expects for authenticated origin pulls. If the provider offers origin CA certs, decide whether you still need public trust for strict modes and rotate before overlap ends. Upload or automate the new chain to the origin listener before touching CDN cache settings.

Bind the full chain on the origin load balancer or web server, reload all origin targets, and verify health checks that use HTTPS if configured. Update CDN origin certificate settings if manual PEM upload is required. Purge or bypass cache for failing dynamic URLs so the edge cannot serve stale success responses while origin TLS is still broken.

Run synthetic transactions through the CDN for API and authenticated routes, not only the marketing homepage. Compare edge versus origin openssl output after deploy. Add independent monitors for both layers with distinct alert routing so the next expiry targets the correct team. Document which origin pool presented the expired material so the next rotation does not repeat the same blind spot.

What to automate

Certificate files on disk lie. Automate live TLS checks on the exact hostname and port users hit, including redirects and the certificate presented after TLS terminates on a load balancer or CDN. Pair certificate notAfter with RDAP domain registration expiry so re-validation is not blocked by a lapsed registrar.

Add origin-only TLS probes that bypass the CDN certificate entirely. Schedule alerts at 30, 14, 7, and 1 day before expiry so on-call has runway for ACME failures, manual OV revalidation, or change windows. Services such as ssldays can run external checks and renewal reminders without replacing your CA workflow.