NginxIngressCertificateExpiring
A certificate that the ingress controller is actually serving will expire soon.
| Severity | warning, critical |
| Source | ingress-nginx controller /metrics (1.9+) |
| Key metric | nginx_ingress_controller_ssl_expire_time_seconds (labels host, and secret_name in recent versions) |
What it means
The controller exports the expiry timestamp of each certificate it loaded. The warning fires when one expires within the next few weeks; critical means only a few days are left and browsers and API clients will soon reject the connection.
Because the metric reflects what NGINX serves, not what sits in the Secret, this also catches cases where the Secret was renewed but the controller never loaded it.
Common causes
- cert-manager renewal failing: ACME HTTP-01 or DNS-01 challenge errors, rate limits, or a broken Issuer.
- Manually managed certificate that nobody rotated.
- Secret renewed but not served: the controller’s config reload is failing, or the Ingress points to a different Secret name.
- Invalid new certificate (key mismatch, wrong SAN), so the controller falls back to the default fake certificate or the old one.
First checks
- List certificates by time left, in days:
sort((nginx_ingress_controller_ssl_expire_time_seconds - time()) / 86400) - Confirm what clients actually receive:
echo | openssl s_client -servername <host> -connect <host>:443 2>/dev/null | openssl x509 -noout -subject -enddate - Compare with the Secret the Ingress references:
kubectl -n <namespace> get ingress <ingress> -o jsonpath='{.spec.tls}' kubectl -n <namespace> get secret <tls-secret> -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -enddate - If cert-manager owns it, check why it has not renewed:
kubectl -n <namespace> describe certificate <name> cmctl status certificate <name> -n <namespace> - Check the controller logs for certificate errors:
kubectl -n ingress-nginx logs deploy/ingress-nginx-controller | grep -i ssl.
Fixing it
Fix the Issuer or challenge problem, then force a renewal with cmctl renew <name> -n <namespace>. For manual certificates, update the Secret with the new tls.crt and tls.key. If the Secret is already fresh but the old certificate is served, fix the failed reload first.
Related alerts
- NginxIngressConfigReloadFailed: a failed reload keeps the old certificate in use.
- CertManagerCertificateExpiringSoon: the same problem seen from cert-manager.
- BlackboxSslCertificateWillExpireSoon: external view of the served certificate.