---
id: 17bd0a27-1056-459c-a796-cb4931c8cb18
---

# SSL certificate probe failure
---

This incident type refers to a situation where the SSL certificate probe failed for a particular instance, which means that the SSL certificate for that instance could not be verified or was found to be invalid. This could be a potential security risk and needs to be investigated and resolved promptly.

### Parameters
```shell
export INSTANCE="PLACEHOLDER"

export SERVICE_OR_APPLICATION_NAME="PLACEHOLDER"

export OLD_CERTIFICATE_FILE="PLACEHOLDER"

export PATH_TO_NEW_SSL_CERTIFICATE_PRIVATE_KEY_FILE="PLACEHOLDER"

export INSTANCE_NAME_OR_IP_ADDRESS="PLACEHOLDER"

export PATH_TO_NEW_SSL_CERTIFICATE_FILE="PLACEHOLDER"

export OLD_CERTIFICATE_KEY_FILE="PLACEHOLDER"
```

## Debug

### Check the SSL certificate for the instance
```shell
openssl s_client -connect ${INSTANCE}:443
```

### Check the SSL certificate expiry date
```shell
openssl s_client -servername ${INSTANCE} -connect ${INSTANCE}:443 2>/dev/null | openssl x509 -noout -enddate
```

### Check the SSL certificate chain
```shell
openssl s_client -connect ${INSTANCE}:443 -showcerts
```

### Check the domain name matches the SSL certificate
```shell
openssl s_client -connect ${INSTANCE}:443 | openssl x509 -noout -text | grep DNS
```

### Check the issuer of the SSL certificate
```shell
openssl s_client -connect ${INSTANCE}:443 | openssl x509 -noout -text | grep Issuer
```

### Check the SSL certificate revocation status
```shell
openssl s_client -connect ${INSTANCE}:443 | openssl x509 -noout -text | grep -A 2 "Revocation"
```

### Check the SSL certificate using SSLyze
```shell
sslyze --regular ${INSTANCE}:443
```

## Repair

### Update the SSL certificate for the affected instance and re-run the certificate probe to ensure that it is being recognized correctly.
```shell


#!/bin/bash



# Set variables

INSTANCE=${INSTANCE_NAME_OR_IP_ADDRESS}

CERT_FILE=${PATH_TO_NEW_SSL_CERTIFICATE_FILE}

CERT_KEY=${PATH_TO_NEW_SSL_CERTIFICATE_PRIVATE_KEY_FILE}



# Stop the service or application using the SSL certificate

sudo systemctl stop ${SERVICE_OR_APPLICATION_NAME}



# Backup the old SSL certificate and private key

sudo cp /etc/ssl/certs/${OLD_CERTIFICATE_FILE} /etc/ssl/certs/${OLD_CERTIFICATE_FILE}.bak

sudo cp /etc/ssl/private/${OLD_CERTIFICATE_KEY_FILE} /etc/ssl/private/${OLD_CERTIFICATE_KEY_FILE}.bak



# Copy the new SSL certificate and private key to the correct directories

sudo cp $CERT_FILE /etc/ssl/certs/

sudo cp $CERT_KEY /etc/ssl/private/



# Set the correct permissions on the new SSL certificate and private key

sudo chmod 644 /etc/ssl/certs/$CERT_FILE

sudo chmod 600 /etc/ssl/private/$CERT_KEY



# Restart the service or application using the SSL certificate

sudo systemctl start ${SERVICE_OR_APPLICATION_NAME}


```

This incident type refers to a situation where the SSL certificate probe failed for a particular instance, which means that the SSL certificate for that instance could not be verified or was found to be invalid. This could be a potential security risk and needs to be investigated and resolved promptly.


This incident type usually occurs when there is a failure in the SSL Handshake process between a client and server running on a Tomcat web server. This can happen for various reasons such as incorrect SSL certificate configuration, cipher suite mismatches, or network connectivity issues. When this type of incident is not resolved quickly, it can lead to downtime or service disruptions for users trying to access the affected service.


Tomcat SSL Handshake Failure Incident

This incident type refers to an issue with Redis replication, which means that there is a problem with the synchronization of data between Redis instances. This issue could impact the availability and performance of the system and may require immediate attention to restore the replication and ensure data consistency. The incident could be caused by various factors, such as network problems, hardware failures, or configuration issues. The incident must be investigated and resolved as soon as possible to avoid any data loss or downtime.


Redis replication broken incident.

This incident type refers to the restart of a MySQL instance that has caused an alert to trigger. It may be related to issues with the MySQL database or the server hosting the instance. The incident requires investigation and resolution to ensure the proper functioning of the affected services.


MySQL instance restart incident

An SSL Certificate Revocation incident refers to an event where the SSL certificate for a particular instance is found to be revoked or invalid. This can cause security issues and disrupt the availability of the service, as clients may not be able to establish a secure connection with the instance. Resolving this incident typically involves renewing or replacing the SSL certificate for the affected instance.


SSL Certificate Revocation

This incident type refers to the failure of a systemd service on a particular host instance. The incident could be triggered by various causes such as a software bug, hardware failure, or system overload. This type of incident can cause downtime or service disruption to the affected host instance, which may require immediate resolution to restore normal operations.


Host systemd service crashed (instance) incident.

```shell
export INSTANCE="PLACEHOLDER"

export SERVICE_OR_APPLICATION_NAME="PLACEHOLDER"

export OLD_CERTIFICATE_FILE="PLACEHOLDER"

export PATH_TO_NEW_SSL_CERTIFICATE_PRIVATE_KEY_FILE="PLACEHOLDER"

export INSTANCE_NAME_OR_IP_ADDRESS="PLACEHOLDER"

export PATH_TO_NEW_SSL_CERTIFICATE_FILE="PLACEHOLDER"

export OLD_CERTIFICATE_KEY_FILE="PLACEHOLDER"
```


### Check the SSL certificate for the instance

```shell
openssl s_client -connect ${INSTANCE}:443
```

### Check the SSL certificate expiry date

```shell
openssl s_client -servername ${INSTANCE} -connect ${INSTANCE}:443 2>/dev/null | openssl x509 -noout -enddate
```

### Check the SSL certificate chain

```shell
openssl s_client -connect ${INSTANCE}:443 -showcerts
```

### Check the domain name matches the SSL certificate

```shell
openssl s_client -connect ${INSTANCE}:443 | openssl x509 -noout -text | grep DNS
```

### Check the issuer of the SSL certificate

```shell
openssl s_client -connect ${INSTANCE}:443 | openssl x509 -noout -text | grep Issuer
```

### Check the SSL certificate revocation status

```shell
openssl s_client -connect ${INSTANCE}:443 | openssl x509 -noout -text | grep -A 2 "Revocation"
```

### Check the SSL certificate using SSLyze

```shell
sslyze --regular ${INSTANCE}:443
```


### Update the SSL certificate for the affected instance and re-run the certificate probe to ensure that it is being recognized correctly.

```shell


#!/bin/bash



# Set variables

INSTANCE=${INSTANCE_NAME_OR_IP_ADDRESS}

CERT_FILE=${PATH_TO_NEW_SSL_CERTIFICATE_FILE}

CERT_KEY=${PATH_TO_NEW_SSL_CERTIFICATE_PRIVATE_KEY_FILE}



# Stop the service or application using the SSL certificate

sudo systemctl stop ${SERVICE_OR_APPLICATION_NAME}



# Backup the old SSL certificate and private key

sudo cp /etc/ssl/certs/${OLD_CERTIFICATE_FILE} /etc/ssl/certs/${OLD_CERTIFICATE_FILE}.bak

sudo cp /etc/ssl/private/${OLD_CERTIFICATE_KEY_FILE} /etc/ssl/private/${OLD_CERTIFICATE_KEY_FILE}.bak



# Copy the new SSL certificate and private key to the correct directories

sudo cp $CERT_FILE /etc/ssl/certs/

sudo cp $CERT_KEY /etc/ssl/private/



# Set the correct permissions on the new SSL certificate and private key

sudo chmod 644 /etc/ssl/certs/$CERT_FILE

sudo chmod 600 /etc/ssl/private/$CERT_KEY



# Restart the service or application using the SSL certificate

sudo systemctl start ${SERVICE_OR_APPLICATION_NAME}


```


SSL certificate probe failure

Overview

Parameters

Debug

Check the SSL certificate for the instance

Check the SSL certificate expiry date

Check the SSL certificate chain

Check the domain name matches the SSL certificate

Check the issuer of the SSL certificate

Check the SSL certificate revocation status

Check the SSL certificate using SSLyze

Repair

Update the SSL certificate for the affected instance and re-run the certificate probe to ensure that it is being recognized correctly.

Learn more

Related Runbooks

Tomcat SSL Handshake Failure Incident

Redis replication broken incident.

MySQL instance restart incident

SSL Certificate Revocation

Support