FM-KED-005 — SSL/TLS Certificate Expiration

Severity: S1 — Critical Recovery Class: B — Standard Recovery Covered by Monthly Support: Yes 

 

 Description 

 SSL/TLS certificates used by Finmars services expire, causing secure connections to fail and rendering applications inaccessible over HTTPS. 

 This issue is time-based and entirely recoverable through certificate renewal. 

 

 Typical Symptoms 

 Browsers displaying certificate expiration warnings HTTPS connections rejected by clients or integrations API calls failing due to TLS handshake errors Monitoring alerts related to certificate validity 

 

 Diagnostic Checklist 

 Verify Certificate Expiration 

 openssl s_client -connect domain:443 -servername domain | openssl x509 -noout -dates 

 Identify Certificate Termination Point 

 Nginx reverse proxy Kubernetes Ingress controller 

 

 Recovery Procedure 

 Follow the procedure relevant to the deployment model. 

 

 Option 1: Renew Certificate in Nginx Proxy 

 Generate or obtain renewed certificate Replace certificate and private key in Nginx configuration Reload Nginx configuration 

 sudo nginx -t

sudo systemctl reload nginx 

 

 Option 2: Renew Certificate in Kubernetes Ingress 

 Renew certificate via the configured certificate manager Update or recreate TLS secret used by the Ingress Verify Ingress reload and certificate propagation 

 

 Preventive Notes 

 Track certificate expiration dates Use automated renewal where possible Monitor certificate validity proactively 

 

 Responsibility Boundary 

 Finmars SCSA provides best-effort renewal guidance and validation. Certificate issuance authority availability and DNS control remain customer responsibilities.