BlackboxSslExpiresSoon: what to do when it fires

Alert rule

alert: BlackboxSslExpiresSoon
expr: (probe_ssl_earliest_cert_expiry{job=~"blackbox.*"} - time()) / 86400 < 14
and (probe_ssl_earliest_cert_expiry{job=~"blackbox.*"} - time()) / 86400 >= 3
and probe_ssl_earliest_cert_expiry{job=~"blackbox.*"} > 0
for: 1h
severity: warning

Alert message: SSL certificate of {{ $labels.instance }} expires in less than 14 days

What it means

Less than 14 days but not less than 3 remain until the certificate expires (for 1 hour in a row). The value comes from probe_ssl_earliest_cert_expiry — the earliest expiry in the whole chain.

Common causes

Automatic renewal (ACME/certbot, cert-manager) did not work, the domain validation path changed, renewal is not configured at all, access to the DNS API was revoked.

Diagnostics

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates
certbot certificates                           # if certbot is used
systemctl list-timers | grep -i certbot
journalctl -u certbot -n 50 --no-pager
kubectl get certificate -A                     # if cert-manager is used

How to fix

Run the renewal manually (certbot renew, reissue via cert-manager), then reload the web server (systemctl reload nginx) so that it picks up the new file. Fix the reason the automation did not work.

When it is OK to silence

For certificates you are deliberately not renewing (the domain is being decommissioned).

Related alerts

The full pack of 44 tested rules + Alertmanager → Telegram: 790 ₽ (≈ $9, card payment in rubles)
Open in Telegram · Free Monitoring Lite kit · All runbook alerts