# FM-KED-005 — SSL/TLS Certificate Expiration

**Severity:**<span style="white-space: pre-wrap;"> S1 — Critical</span>  
**Recovery Class:**<span style="white-space: pre-wrap;"> B — Standard Recovery</span>  
**Covered by Monthly Support:**<span style="white-space: pre-wrap;"> Yes</span>

---

### Description

SSL/TLS certificates used by Finmars services expire, causing secure connections to fail and rendering applications inaccessible over HTTPS.

This issue is time-based and entirely recoverable through certificate renewal.

---

### Typical Symptoms

- Browsers displaying certificate expiration warnings
- HTTPS connections rejected by clients or integrations
- API calls failing due to TLS handshake errors
- Monitoring alerts related to certificate validity

---

### Diagnostic Checklist

#### Verify Certificate Expiration

```bash
openssl s_client -connect domain:443 -servername domain | openssl x509 -noout -dates
```

#### Identify Certificate Termination Point

- Nginx reverse proxy
- Kubernetes Ingress controller

---

### Recovery Procedure

Follow the procedure relevant to the deployment model.

---

#### Option 1: Renew Certificate in Nginx Proxy

- Generate or obtain renewed certificate
- Replace certificate and private key in Nginx configuration
- Reload Nginx configuration

```bash
sudo nginx -t
sudo systemctl reload nginx
```

---

#### Option 2: Renew Certificate in Kubernetes Ingress

- Renew certificate via the configured certificate manager
- Update or recreate TLS secret used by the Ingress
- Verify Ingress reload and certificate propagation

---

### Preventive Notes

- Track certificate expiration dates
- Use automated renewal where possible
- Monitor certificate validity proactively

---

### Responsibility Boundary

Finmars SCSA provides best-effort renewal guidance and validation.  
Certificate issuance authority availability and DNS control remain customer responsibilities.

---