BlackboxSslCertificateWillExpireSoon

An endpoint probed over TLS is serving a certificate chain that expires soon.


Severity	warning, critical
Source	blackbox_exporter `/probe` (http or tcp module with TLS)
Key metric	`probe_ssl_earliest_cert_expiry` (Unix time of the first certificate in the chain to expire)

What it means

On every TLS probe the exporter records when the soonest-expiring certificate in the presented chain runs out. The alert compares that with the current time. The warning fires a couple of weeks ahead, when there is time for a normal renewal. The critical fires when only a few days remain and an outage is imminent.

Once the certificate expires, browsers and API clients refuse to connect, so this is a guaranteed outage with a known date.

Common causes

Automated renewal (cert-manager, certbot, a cloud provider) silently failing, often due to a broken ACME HTTP-01 or DNS-01 challenge.
A renewed certificate that was issued but never deployed or reloaded by the web server or ingress.
An expiring intermediate certificate in the chain, not the leaf.
Manually managed certificates nobody owns anymore.
Several backends behind one hostname, with only some serving the renewed certificate.

First checks

List certificates by days left:

sort((probe_ssl_earliest_cert_expiry - time()) / 86400)

Inspect what the endpoint serves right now:

openssl s_client -connect <host>:443 -servername <host> -showcerts </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -enddate

If the leaf looks fine, check the intermediates printed by -showcerts.

Use the exporter debug output to see the chain it received:

curl -s "http://<blackbox-exporter>:9115/probe?target=https://<host>&module=<module>&debug=true"

For cert-manager managed certificates:

kubectl get certificate -A
cmctl status certificate <name> -n <namespace>

Fixing it

Fix the renewal path (challenge, DNS credentials, rate limits), then force renewal, for example cmctl renew <name> -n <namespace>. Make sure the ingress or server picks up the new secret; some need a reload. Replace an expiring intermediate by serving the chain your CA currently provides.

BlackboxProbeFailed: what happens once the certificate actually expires.
BlackboxExporterProbeScrapeFailed: without scrapes, expiry data goes stale.
BlackboxSlowProbe: TLS handshake issues also show up as slow probes.