An expired certificate can break every request before an AI gateway reaches a model. Public APIs fail, internal inference services become unreachable, MCP connections stop, and deployment health checks may cascade into rollbacks.

Treat expiry as a production incident and a failed automation control—not a reason to bypass verification.

Confirm the certificate actually being served

openssl s_client -connect ai.example.com:443 -servername ai.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

Check the hostname, issuer, notBefore, and notAfter. Also confirm system time. If renewal already ran, the load balancer, CDN, ingress, or proxy may still be serving an old certificate.

Find the termination point

The certificate may terminate at a CDN, managed load balancer, Kubernetes ingress, reverse proxy, API gateway, or the application itself. Renew and reload at the component actually serving the connection. Then test every region and replica.

Internal services require the same discipline. Inventory certificates used for service-to-service TLS and mTLS; a healthy public endpoint does not prove internal model or MCP certificates are current.

Safe recovery

1. Renew or reissue through the existing approved CA workflow.
2. Deploy the leaf certificate with the correct intermediate chain.
3. Keep private keys in the secrets system with restricted access.
4. Reload or roll the terminating service safely.
5. Verify the served certificate from outside and inside the network.
6. Exercise an authenticated AI request and a streaming response.
7. Confirm old certificates and keys are retired according to policy.

Do not use curl -k, disabled verification, or a globally trusted self-signed certificate as the production fix.

Prevent silent renewal failures

• Monitor remaining validity independently of the renewal job.
• Alert well before expiry and escalate repeated failures.
• Test renewal against DNS, HTTP challenge, and firewall changes.
• Verify deployment and reload after issuance.
• Cover all SAN hostnames and environments.
• Make renewal credentials short-lived and least-privileged where supported.
• Rehearse rotation for internal CAs and mTLS clients.

For chain problems after renewal, see TLS certificate chain errors. For negotiation problems, use TLS handshake failures.

Tie ownership to the AI Security hub, release checks to AI Deployment & Hosting, and expiry/error monitoring to AI Operations. Certificate renewal is production automation and must be tested like any other critical deployment path.