WebSocket connection failed certificate expired

websocket ssl certificate expired means the wss upgrade never completes because TLS handshake rejects an expired leaf—browsers close sockets before 101 Switching Protocols.

Realtime dashboards freeze, chat widgets disconnect, and mobile apps log SSL handshake error while static https pages still load from cache or a different hostname. Operators chase CORS when the failure is earlier in TLS.

WebSockets reuse the HTTPS listener certificate on the same host and port 443 in most designs. openssl the wss hostname, renew the terminator cert, reload, then retry the socket.

First response

Capture browser devtools Network WS row status and TLS error, client library (ws, Socket.IO), and exact wss URL including path. Attach openssl s_client for the WebSocket host with SNI and note whether a CDN proxies WebSocket separately from HTML.

Note if only long-lived connections fail after running for days—that pattern still points to cert crossing notAfter mid-session, forcing reconnect failures.

Compare with curl SSL certificate expired on the same host and NET::ERR_CERT_INVALID when browser interstitials appear during socket open.

What this error means

wss is HTTPS plus Upgrade: websocket. The TLS handshake runs first with the same certificate the server would use for GET /.

Browsers and Node clients validate notAfter before HTTP headers exchange. Certificate expiry therefore blocks WebSockets and REST on that hostname together unless split hostnames or ports are used.

Sticky sessions do not help: every new socket repeats full TLS negotiation with current served material.

Common causes

Shared ingress cert expired. Kubernetes ingress or nginx serves one cert for SPA and /socket path—both break together.

Separate wss subdomain neglected. api.example.com renewed while stream.example.com lapsed.

CDN orange-cloud with expired custom cert. Edge still caches old PEM while origin was renewed.

Load balancer WebSocket profile on old default cert. SNI rules missing for wss host.

Corporate proxy inspects WebSocket TLS differently. Off-network clients succeed; compare openssl from both paths.

Socket.IO polling fallback still uses HTTPS. Both transports fail when the leaf expired—do not assume polling bypasses TLS.

Confirm from the outside

OpenSSL

HOST=stream.example.com
echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer

wscat probe

npx wscat -c "wss://${HOST}/path" 2>&1

Upgrade headers test

curl -v --http1.1 -H "Connection: Upgrade" -H "Upgrade: websocket" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" -H "Sec-WebSocket-Version: 13" \
  "https://${HOST}/socket" 2>&1 | grep -Ei 'SSL|expire|certificate'

How to read the output

Expired notAfter on 443 for the wss host explains socket failures. If dates are valid, inspect trust issues. Successful openssl but failing wscat may indicate path-based routing to a different upstream with stale cert.

Fix checklist

1. Reproduce wss failure with verification enabled.
2. openssl the exact hostname in client code, not only the marketing apex domain.
3. Renew certificate on terminator (ingress, nginx, API gateway, CDN).
4. Reload or roll pods so data plane serves new fullchain.
5. Purge CDN if edge cert was stale.
6. Confirm browser WS handshake returns 101 and stable frames.
7. Remove client rejectUnauthorized: false hacks.
8. Monitor live TLS on all wss hostnames.

Retest mobile apps and browser tabs in parallel—cached service workers can delay visible recovery even after TLS is fixed.

websocket ssl certificate expired rollouts should invalidate CDN caches when the wss host shares edge certificates with static assets. Reload ingress controllers even when Secret resourceVersion changed—many data planes cache TLS context until pod recycle. Capture a browser HAR or devtools WS timeline showing HTTP 101 after fix for the incident record.

Triage myths: tweaking Socket.IO transport alone does not bypass expiry on wss. CORS errors in the console often appear after TLS already failed—read the TLS tab first. When only mobile apps fail, they may use a different stream subdomain than the web SPA—openssl each hostname from the app config.

Synthetic monitors that only GET the marketing homepage miss dedicated wss hosts used for tickers and chat—add handshake checks aligned with the JavaScript connect URL, not only the apex domain.

Frontend leads should list every wss endpoint in the deployment checklist next to API base URLs—websocket ssl certificate expired outages look like application bugs in Sentry while openssl already shows stale notAfter. After renewal, force-reload long-lived kiosk browsers that keep dead sockets open across cert rollover.

Gaming and trading desks with always-on wss feeds should rehearse renewal quarterly—reconnect storms after unexpected expiry cost more than a five-minute openssl drill in staging.

When websocket ssl certificate expired hits multi-tenant SaaS, publish a status page note naming the stream hostname so customers can run openssl independently instead of guessing which API key failed.

Engineering managers should tie wss health to the same error budget as REST latency—silent TLS failures drop realtime revenue before HTTP error rates move.

When to use automation

Uptime monitors that only GET / miss dedicated wss hosts. Run live TLS checks on every hostname used in WebSocket client config. Validate quickly via /check; alert at 30, 14, 7, and 1 days before realtime features die at night.

Pair RDAP on streaming subdomains so DNS transfers do not delay the next renewal.