Quick troubleshooting view
Browsers or applications refuse to connect because the certificate submitted is no longer valid in time.
- automatic renewal failed
- new non-service-related certificate
- certificate renewed but old still presented
- Check the certificate submitted
- Compare local store
- Controlling the ABM
- renew the certificate
- explicitly link the new certificate to the service
- restart or reload only the required component
Contextual technician plan
Check the date of expiry from the customer's point of view.
opensl s_client -connect example.fr:443 -servername example.frThe command should complete without an unexpected error and return data consistent with the intended service.
If the result is normal, keep this layer lower in the hypothesis ranking and continue with the next discriminating check.
If the result is abnormal, preserve the output and investigate this layer before making broader changes.
Check that the new certificate exists on the server.
“Compare local store” should produce an observation that clearly confirms or rules out “new non-service-related certificate”.
If the observation is normal, lower “new non-service-related certificate” in the ranking and continue with the next distinct check.
If the observation is abnormal, keep the evidence and investigate “new non-service-related certificate” first. Related action: explicitly link the new certificate to the service.
Identify the certificate actually linked to IIS, reverse proxy or event.
“Controlling the ABM” should produce an observation that clearly confirms or rules out “certificate renewed but old still presented”.
If the observation is normal, lower “certificate renewed but old still presented” in the ranking and continue with the next distinct check.
If the observation is abnormal, keep the evidence and investigate “certificate renewed but old still presented” first. Related action: restart or reload only the required component.
Control intermediaries after replacement.
“Check the string” should produce an observation that clearly confirms or rules out “incorrect system time”.
If the observation is normal, lower “incorrect system time” in the ranking and continue with the next distinct check.
If the observation is abnormal, keep the evidence and investigate “incorrect system time” first. Related action: correct l, ACME automation for next renewal.
Repeat the same validation test after the correction and confirm the original symptom is gone. Validate stability before closing the incident.
Before changing configuration, record the current value and a way back.
Crack if the certificate is renewed but a proxy, load swing or CDN continues to present the, old.
Browsers or applications refuse to connect because the certificate submitted is no longer valid in time.
Causes probables
- automatic renewal failed
- new non-service-related certificate
- certificate renewed but old still presented
- incorrect system time
Diagnostic étape par étape
- 1
Check the certificate submitted
Check the date of expiry from the customer's point of view.
- 2
Compare local store
Check that the new certificate exists on the server.
- 3
Controlling the ABM
Identify the certificate actually linked to IIS, reverse proxy or event.
- 4
Check the string
Control intermediaries after replacement.
Commands utiles
opensl s_client -connect example.fr:443 -servername example.frSolutions possibles
- renew the certificate
- explicitly link the new certificate to the service
- restart or reload only the required component
- correct the ACME automation for next renewal
Crack if the certificate is renewed but a proxy, load swing or CDN continues to present the, old.