BlackboxSslExpiresCritical: what to do when it fires

Alert rule

alert: BlackboxSslExpiresCritical
expr: (probe_ssl_earliest_cert_expiry{job=~"blackbox.*"} - time()) / 86400 < 3
and probe_ssl_earliest_cert_expiry{job=~"blackbox.*"} > 0
for: 10m
severity: critical

Alert message: SSL certificate of {{ $labels.instance }} expires in less than 3 days

What it means

Less than 3 days remain until the certificate expires, or it has already expired. Users will soon see a browser error, and API clients will start refusing the connection.

Common causes

The same as for BlackboxSslExpiresSoon, but the renewal was not done in time. It is also possible that the web server did not reload the renewed certificate.

Diagnostics

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
ls -l /etc/letsencrypt/live/<domain>/ 2>/dev/null
nginx -t && systemctl status nginx --no-pager

If the file on disk is new but the server serves the old one, the server has not been reloaded.

How to fix

Renew or issue the certificate manually right away, reload the web server/load balancer, and verify the result with openssl s_client.

When it is OK to silence

Not until the certificate is renewed.

Related alerts

• BlackboxSslExpiresSoon
• BlackboxHttpStatusNotOk
• BlackboxSlowResponse
• BlackboxProbeFailed

The full pack of 44 tested rules + Alertmanager → Telegram: 790 ₽ (≈ $9, card payment in rubles)
Open in Telegram · Free Monitoring Lite kit · All runbook alerts