Fractal Techware

Alert runbooks /

NginxIngressCertificateExpiring

A certificate that the ingress controller is actually serving will expire soon.

   
Severity warning, critical
Source ingress-nginx controller /metrics (1.9+)
Key metric nginx_ingress_controller_ssl_expire_time_seconds (labels host, and secret_name in recent versions)

What it means

The controller exports the expiry timestamp of each certificate it loaded. The warning fires when one expires within the next few weeks; critical means only a few days are left and browsers and API clients will soon reject the connection.

Because the metric reflects what NGINX serves, not what sits in the Secret, this also catches cases where the Secret was renewed but the controller never loaded it.

Common causes

First checks

  1. List certificates by time left, in days:
    sort((nginx_ingress_controller_ssl_expire_time_seconds - time()) / 86400)
    
  2. Confirm what clients actually receive:
    echo | openssl s_client -servername <host> -connect <host>:443 2>/dev/null | openssl x509 -noout -subject -enddate
    
  3. Compare with the Secret the Ingress references:
    kubectl -n <namespace> get ingress <ingress> -o jsonpath='{.spec.tls}'
    kubectl -n <namespace> get secret <tls-secret> -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -enddate
    
  4. If cert-manager owns it, check why it has not renewed:
    kubectl -n <namespace> describe certificate <name>
    cmctl status certificate <name> -n <namespace>
    
  5. Check the controller logs for certificate errors: kubectl -n ingress-nginx logs deploy/ingress-nginx-controller | grep -i ssl.

Fixing it

Fix the Issuer or challenge problem, then force a renewal with cmctl renew <name> -n <namespace>. For manual certificates, update the Secret with the new tls.crt and tls.key. If the Secret is already fresh but the old certificate is served, fix the failed reload first.