Browsers or applications refuse to connect because the certificate submitted is no longer valid in time.
Probable causes
- automatic renewal failed
- new non-service-related certificate
- certificate renewed but old still presented
- incorrect system time
Verifications.
- Check the certificate submitted — Check the expiry date from the customer’s point of view.
- Compare local store — Check that the new certificate exists on the server.
- Controlling the ABM — Identify the certificate actually linked to IIS, reverse proxy or event.
- Check the string — Control intermediaries after replacement.
Commands
openssl s_client -connect exemple.fr:443 -servername exemple.frSolutions.
- renew the certificate
- explicitly link the new certificate to the service
- restart or reload only the required component
- correct the ACME automation for next renewal
When to climb?
Crack if the certificate is renewed but a proxy, load swing or CDN continues to present the, old.