Use this runbook when browsers or API clients reject the hostname with a certificate date or name error. First action: read notBefore, notAfter and the SAN list from the certificate the client actually sees, then find that certificate in ACM, Key Vault, Certificate Manager or Alibaba Certificate Management Service. Do not delete the expired certificate from the load balancer until the replacement is attached and a probe succeeds. ACM Amazon-issued certificates can auto-renew; imported certificates and many self-managed files do not. Azure Application Gateway should reference a Key Vault secret URI without a version so a new version can roll forward.

Read the certificate on the wire first. The console object you think is attached may not be the one clients see.

Symptoms

Browsers show a date error. API clients log certificate has expired or a hostname mismatch. A listener, CloudFront or Front Door custom domain, API Gateway, or ingress still presents the old leaf. ACM or Certificate Manager shows PENDING_VALIDATION on a renewal that never finished. A name mismatch after a DNS change is not expiry; see DNS routing failure.

Business impact

Clients that validate certificates refuse the connection. That is an HTTPS, gRPC and often mTLS outage. Deleting the only certificate on a listener drops TLS immediately.

Immediate checks

  1. From a machine that is not inside a corporate intercept, capture the presented certificate:
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -issuer -dates -ext subjectAltName
  1. List every TLS terminator for that name: ALB/NLB, CloudFront, API Gateway, Application Gateway, Front Door, Cloud Load Balancing, Alibaba SLB or CDN, Kubernetes ingress.
  2. Confirm whether the certificate is provider-managed (ACM Amazon-issued, Google-managed, Key Vault integrated issuance) or imported / self-managed.
  3. Confirm DNS still points at the terminator you are about to update.

Provider commands and console paths

AWS Certificate Manager. ACM console in the same region as the load balancer (CloudFront certificates live in us-east-1). ACM overview states ACM does not manage renewal for imported certificates the same way it does for Amazon-issued ones.

aws acm list-certificates --certificate-statuses ISSUED EXPIRED FAILED PENDING_VALIDATION
aws acm describe-certificate --certificate-arn arn:aws:acm:REGION:ACCOUNT:certificate/ID

See describe-certificate. Then check the listener:

aws elbv2 describe-listeners --load-balancer-arn ARN
aws elbv2 describe-listener-certificates --listener-arn ARN

Azure Key Vault and Application Gateway. Key Vault, Certificates. Application Gateway HTTPS listener. Microsoft documents Key Vault integration and recommends a secret identifier without a version so the gateway can pick up a new version (TLS termination with Key Vault certificates).

az keyvault certificate show --vault-name VAULT --name CERT
az keyvault certificate list --vault-name VAULT
az network application-gateway ssl-cert list --resource-group RG --gateway-name APPGW
az network application-gateway http-listener show --resource-group RG --gateway-name APPGW --name LISTENER

Front Door custom domains have their own certificate source in the Front Door blade. Use that UI or the current az afd certificate commands rather than guessed flags.

Google Certificate Manager. Certificate Manager, certificates, then the certificate map or target HTTPS proxy. Certificate Manager overview.

gcloud certificate-manager certificates list
gcloud certificate-manager certificates describe CERT
gcloud certificate-manager maps list

Classic target-https-proxy certificates still exist on some load balancers:

gcloud compute target-https-proxies describe PROXY

Alibaba Cloud. Certificate Management Service (SSL Certificates) console. Deploy or bind the certificate to SLB, CDN or the product that terminates TLS. Help: Certificate Management Service. Use the console bind/deploy flow if you do not have a verified aliyun cas command for your CLI version.

Interpretation

notAfter in the past: expiry. Replace and attach.

notAfter in the future, wrong SAN: you attached a cert for another name, or DNS moved to a host that still has the old cert.

PENDING_VALIDATION: DNS or HTTP validation records are missing. The new cert will not issue until validation completes. Do not delete the old cert yet.

Amazon-issued ACM or Google-managed cert eligible for renewal but not renewed: check CAA, validation CNAME, and whether the load balancer still uses that ACM/Certificate Manager object.

Imported PFX/PEM: you own the calendar. The platform will not renew it unless you built that pipeline.

Application Gateway still on a versioned Key Vault URI: new versions in the vault will not apply until you change the reference.

Safe mitigation

Issue or import the new certificate first. Attach it to the listener, custom domain or certificate map. Confirm a probe. Then detach the expired one. For ACM Amazon-issued certs, wait until describe-certificate shows the new NotAfter on the same ARN. For Key Vault, upload a new version and use an unversioned secret URI on Application Gateway v2. For Kubernetes ingress, apply the new Secret before you delete the old one.

Risky actions to avoid

Do not delete the expired certificate from ACM, Key Vault or Certificate Manager while it is still the only cert on a listener.

Do not paste a private key into a ticket or chat.

Do not disable TLS or switch the listener to HTTP to “restore service” on a name that must stay HTTPS.

Do not reuse an expired cert by changing the system clock on clients.

Validation

openssl s_client shows the new notAfter and SAN. https:// the name returns the application, not a handshake error. Each terminator references the new certificate. Check CDN plus origin so you did not update only the origin.

Prevention

  1. Prefer managed certificates with a documented auto-renewal path (ACM issued-in-account, Key Vault integrated issuers, Certificate Manager Google-managed, Alibaba hosted certs where that product applies).
  2. Give every imported certificate a named owner and an alert before notAfter. Imported certs do not renew themselves.
  3. Alert on ACM expiry events, Key Vault certificate expiry, Certificate Manager state, and Alibaba SSL console notices.
  4. On Application Gateway v2, use an unversioned Key Vault secret URI so rotation is picked up. A pinned version will expire in place.
  5. After any DNS or listener change, probe the hostname with openssl s_client from outside the VPC.
  6. Renewal differs for imported versus managed certificates. Do not assume one provider’s ACM behaviour applies to Key Vault or Alibaba SSL.

Official sources