Load balancer presenting an expired certificate

Users see the load balancer listener certificate, not the PEM sitting unused on a backend instance.

Teams renew on the origin while the ALB/NLB or F5 VIP still binds last year’s ARN or default cert.

Autoscaling backends swap hourly; the stable TLS identity lives on the listener fronting them.

First response

Clients hit the load balancer certificate, not the backend file on disk. When the listener or default cert expires, every target fails TLS until you attach a renewed chain.

Search interest in load balancer ssl certificate expired rises when the leaf notAfter on the hostname customers type is already in the past. Clients cannot rewrite server certificate dates; they only accept chains that pass PKIX checks at handshake time.

For Load balancer presenting an expired certificate, prove the failure from outside your office VPN before you change application code, purge caches, or ask end users to reboot. Capture the broken serial number and notAfter, renew on the listener that actually terminates that name, reload every node in the path, then re-run the same OpenSSL and browser checks that opened the incident.

Escalations for load-balancer-ssl-expired should cite fresh openssl to the VIP with correct -servername per rule output before anyone edits client code or blames Wi‑Fi. Clients hit the load balancer certificate, not the backend file on disk. When the listener or default cert expires, every target fails TLS until you attach a renewed chain. When uniform failures across all pool members clusters around Clients negotiating with ALB or NLB listeners, the expired material is usually bound to listener default or SNI-selected certificate instead of a mysterious platform bug. Executive summaries need the public hostname and current notAfter, not screenshots from a VPN-split test laptop.

See also curl: SSL certificate problem: certificate has expired and wget certificate verify failed expired.

What this error means

Cloud load balancers terminate TLS and present their attached certificate set. Expired listener certs fail every target group at once.

SNI rules route hostnames to different certs; a forgotten rule may still point at an expired default.

Upload renewed cert or attach managed cert to the listener, wait for propagation, verify externally.

In PKIX terms, Clients negotiating with ALB or NLB listeners treat the TLS Certificate message as authoritative: signatures must verify, each link must be within notBefore/notAfter, and only then does name matching run against CN and SAN. When the leaf expired, uniform failures across all pool members is expected even if the issuer is publicly trusted. Guides titled load balancer ssl expired still require reading dates on every certificate the server sends, including forgotten cross-sign intermediates.

Triage for load balancer ssl expired should reject quick myths: flushing DNS or rebooting laptops does not move server notAfter forward. It is not proof the whole internet is broken when other HTTPS sites load for Clients negotiating with ALB or NLB listeners. It is not interchangeable with registrar billing lapses unless revalidation fails later. It is not fixed by turning off TLS at the load balancer while marketing keeps publishing https:// links. Validated externally, openssl to the VIP with correct -servername per rule must show fresh dates on listener default or SNI-selected certificate before you close the incident.

Common causes

These patterns appear often during load balancer ssl certificate expired incidents. They are not exhaustive, but they explain why renewal looked finished internally while strangers still received expired material.

Runbooks for load balancer ssl expired most often break at handoff: certbot or a vendor portal issued new certs, but listener default or SNI-selected certificate never received a reload. Teams tracked PEM files in git while production continued serving the previous listener binding. OV renewals waited on legal approvers until uniform failures across all pool members became customer-visible. Inventory spreadsheets omitted the hostname that Clients negotiating with ALB or NLB listeners actually call during peak traffic.

Architecture amplifies load balancer ssl expired: multiple regions, canary pools, or blue/green deploys can leave one ASG member presenting yesterday's fullchain. Shared IP default certificates silently terminate vanity hostnames without dedicated SNI rules. Mounted TLS secrets updated on disk while Envoy or nginx workers kept the old chain until signaled. Clients hit the load balancer certificate, not the backend file on disk becomes harder to debug when only a fraction of Clients negotiating with ALB or NLB listeners hit the stale anycast node.

Measurement gaps complete the story for load balancer ssl expired. Synthetic monitors that disable certificate verification greenlit deploys that fail for real Clients negotiating with ALB or NLB listeners. Redirect maps hid which hop expired until operators ran openssl to the VIP with correct -servername per rule per hostname. Dashboards celebrated TCP uptime while notAfter crossed midnight UTC without a page. Post-mortems should ask whether CT logs or stapled OCSP would have warned days earlier.

Confirm from the outside

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

openssl shows which CN/SAN the LB presents—compare to console binding.

How to read the output

Start with openssl to the VIP with correct -servername per rule against the live customer hostname, capturing the leaf presented after SNI selection. Interpret notBefore= and notAfter= first: past notAfter guarantees failure for uniform failures across all pool members regardless of pretty issuer branding. Next read subject= and any X509v3 Subject Alternative Name extension for alignment with the URL bar. Finally note issuer= so you know whether renewal changed intermediates; record serial numbers in the ticket for post-deploy diffing.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Hit the public VIP or DNS name curl uses in production.

Browser spot-check

Padlock subject should match listener cert, not internal backend hostname.

Fix checklist

Work this list in order for load balancer presenting an expired certificate. Each step should produce evidence (command output, timestamps, serial numbers) you can paste into the incident ticket.

1. Map DNS to load balancer name and listener ARN.
2. List all listener certificates and expiries in console/API.
3. Import renewed cert or switch to managed renewal.
4. Update SNI mappings for all hostnames.
5. Drain/reload if platform requires for cert swap.
6. OpenSSL each hostname rule after change.
7. Confirm backend health checks still pass.
8. Tag certificates with owner and renewal ticket ids.

Roll out and verify

Procurement for load balancer ssl expired begins with a reissue that lists every hostname Clients negotiating with ALB or NLB listeners need, including forgotten admin and callback URLs. Validate CSR/key pairs, download CA bundles, and schedule work on listener default or SNI-selected certificate during a staffed change window. If automation handles ACME, prove challenges use the same DNS names customers resolve publicly, not internal-only labels.

Installation for load balancer ssl expired means concatenating leaf and required intermediates the way your stack documents, then touching every node that terminates the name. Reload web servers, recycle ingress pods, or update cloud listener objects so data planes read new bytes. For load balancers, sync default and per-host certificates so SNI cannot fall back to expired defaults. Repeat openssl to the VIP with correct -servername per rule until fingerprints or serials change everywhere responders tested earlier.

Verification for load balancer ssl expired must mimic strangers: external synthetics, mobile carriers, and CI jobs without corporate trust roots. Confirm uniform failures across all pool members disappeared for Clients negotiating with ALB or NLB listeners on flows heavier than GET /. Restore any strict TLS, HSTS, or CDN SSL modes relaxed during firefighting. Feed the hostname into continuous notAfter monitoring with thresholds well before the next CA-enforced renewal cliff.

What to automate

Certificate files on disk lie. Automate live TLS checks on the exact hostname and port users hit, including redirects and the certificate presented after TLS terminates on a load balancer or CDN. Pair certificate notAfter with RDAP domain registration expiry so re-validation is not blocked by a lapsed registrar.

Export listener cert expiry metrics via cloud API daily. Schedule alerts at 30, 14, 7, and 1 day before expiry so on-call has runway for ACME failures, manual OV revalidation, or change windows. Services such as ssldays can run external checks and renewal reminders without replacing your CA workflow.