TLS / certificate expired

Symptom

'certificate has expired', 'SSL handshake failed', clients suddenly cannot connect (with no code change).

1. Where does it break: server, client or CA?

Is it the server certificate that expired, a client certificate, or a CA in the chain? The symptom is usually 'it worked yesterday, it doesn't work today, no code changed'.

2. Check the expiry

Read the certificate's expiry date directly from the server (a quick, database-independent method).

PostgreSQL

openssl s_client -connect host:5432 -starttls postgres </dev/null 2>/dev/null | openssl x509 -noout -dates

MongoDB

openssl s_client -connect host:27017 </dev/null 2>/dev/null | openssl x509 -noout -enddate

Redis

openssl s_client -connect host:6379 </dev/null 2>/dev/null | openssl x509 -noout -enddate

3. Install and load the new certificate

Replace the certificate and, in most cases, reload the service without restarting it.

PostgreSQL

-- Renew ssl_cert_file/ssl_key_file, then:
SELECT pg_reload_conf();

MySQL

ALTER INSTANCE RELOAD TLS;

SQL Server

-- SQL Server Configuration Manager > Certificate; a service restart is required

MongoDB

// Renew the net.tls.certificateKeyFile file (at the same path), then load it without a restart (5.0+):
db.adminCommand({rotateCertificates: 1})

Redis

CONFIG SET tls-cert-file /path/new.crt
CONFIG SET tls-key-file /path/new.key

Elasticsearch

# ES watches the certificate/key files (PEM, PKCS#12) defined under xpack.security.*.ssl and
# reloads them automatically when the file at the SAME path changes (no restart needed).
# If the path, file name or keystore password changes, a rolling restart is required.
# Note: POST _nodes/reload_secure_settings is only for reloadable keystore settings, not for TLS certificates.
# Verify: check the new expiry date with openssl s_client and look in the ES logs for
# an entry showing the certificate was reloaded.

4. Verify

Confirm with the openssl command above that the TLS handshake succeeds with the new certificate and that the expiry has been extended; connect end-to-end with a client.

5. Permanent: never again

Set up an alert 30 days before certificate expiry; use automated renewal (ACME/Let's Encrypt, HashiCorp Vault, cert-manager). Automate the reload after renewal.