Expired TLS certificate

When a certificate used by your GitHub Enterprise Server instance expires, services can no longer validate TLS connections. Users may be unable to access the instance, and features that depend on internal connections stop working.

In this article

Symptoms

  • Users cannot access the instance.
  • Pull requests do not update with new pushes.
  • Webhooks are not delivered, and GitHub Actions workflows are not triggered.
  • /var/log/github/exceptions.log contains certificate verify failed errors.

Causes

Every certificate is only valid between its notBefore and notAfter dates. If the certificate for your instance, or any intermediate or root certificate in its chain, has expired, validation fails.

Custom certificate authority (CA) certificates installed on the instance can expire in the same way.

Confirming the problem

  1. SSH into the administrative shell. For more information, see Accessing the administrative shell (SSH).

  2. Check the validity dates of the certificate the instance is using.

    openssl x509 -in /etc/haproxy/ssl.crt -noout -subject -dates

    If the notAfter date has passed, the certificate has expired.

  3. If you have installed custom CA certificates, list them.

    ghe-ssl-ca-certificate-install -l

  4. Check the validity dates of each one, replacing CERTIFICATE with a file name from the list.

    openssl x509 -in /usr/local/share/ca-certificates/CERTIFICATE -noout -subject -dates

Resolving the problem

Warning

Replacing a certificate starts a configuration run, which restarts services. Enable maintenance mode first to reduce the impact on users. For more information, see Enabling and scheduling maintenance mode.

  1. Upload a valid certificate, or enable Let's Encrypt to manage the certificate for you. For more information, see Configuring TLS.

    Include the full certificate chain in the file you upload. For more information, see Troubleshooting TLS errors.

  2. For each expired custom CA certificate, remove it with ghe-ssl-ca-certificate-install -r if it is no longer needed. If the instance still needs to trust that CA, install a valid replacement with ghe-ssl-ca-certificate-install -c instead. Then apply the configuration. For more information, see Command-line utilities.

  3. If you enabled maintenance mode, disable it once the configuration run has finished.

Contacting GitHub Support

If your certificate is in date but you see the symptoms above, an intermediate or root certificate in the chain may have expired. If you cannot confirm this, or the problems continue after you replace the certificate, contact GitHub Support. For more information, see Creating a support ticket.

Do not send your private key to GitHub Support.

If you have already opened a ticket, attaching a support bundle helps GitHub Support diagnose the problem faster. For more information, see Providing data to GitHub Support.

Further reading