certificate_expired
certificate_expired (45) is sent when a certificate's validity period has passed – its notAfter date is in the past, or its notBefore date is in the future. This is the most operationally common TLS error in production systems. Automate certificate renewal with ACME (Let's Encrypt) to prevent expiry.
Alert Code
45
Level
Fatal
Standard
RFC 8446
Description
certificate_expired is triggered when the current time falls outside the certificate's validity window (notBefore to notAfter). Let's Encrypt certificates expire after 90 days. Commercial certificates typically last 1 year (browsers now cap at 398 days). The fix is certificate automation via ACME protocol – certbot, Caddy, or Traefik handle this automatically. Clock skew between client and server can also cause certificate_expired if the server's clock is significantly behind.
Common Causes
- –Certificate's notAfter date has passed
- –Certificate's notBefore date is in the future (clock skew)
- –Automated renewal failed silently
- –Manual certificate renewal was missed
- –Client clock is significantly ahead of server clock