# NautheraServerCertificateExpiringSoon

A certificate a nauthera-server listener serves expires within seven days.

## Meaning

`nauthera_tls_certificate_expiration_timestamp_seconds` for a listener (`http` for the
in-pod HTTPS listener, `grpc` for the AdminService) is less than the threshold (7 days)
away, for an hour. The `http` certificate is read only at startup, so a certificate
cert-manager renewed is not served until the pods restart. The `grpc` certificate is the
one last taken into use at a handshake, which reads the files at most every 30 seconds:
the file was not renewed, it was renewed but could not be loaded
(`grpc_tls_reload_failed` in the log), or no client has connected since. A certificate
the ingress serves is not measured here.

## Impact

Nothing yet. If it expires: for `http`, every browser and relying party connecting
directly to the pods fails TLS, so sign-in and token requests stop. For `grpc`, the
operator and `nauthera-cli` cannot connect; clients already registered keep working.

## Diagnosis

1. Which listener and replicas: `(nauthera_tls_certificate_expiration_timestamp_seconds\{
   job="<name>"\} - time()) / 86400`.
2. Has cert-manager renewed it? `kubectl -n <ns> get certificates` and
   `kubectl -n <ns> describe certificate <certificate>` (Ready condition, renewal time,
   events). The chart renews both 15 days before expiry by default
   (`certManager.httpTLS.renewBefore`, `certManager.grpcTLS.renewBefore`).
3. What the Secret holds now: `kubectl -n &lt;ns&gt; get secret &lt;secret&gt; -o
   jsonpath='\{.data.tls\.crt\}' | base64 -d | openssl x509 -noout -enddate`.
4. For `grpc`: `kubectl -n &lt;ns&gt; logs &lt;pod&gt; | jq 'select(.msg=="grpc_tls_reload_failed"
   or .msg=="grpc_tls_reloaded")'`.

## Mitigation

- `http`, Secret already renewed: restart the pods, `kubectl -n &lt;ns&gt; rollout restart
  deploy/&lt;name&gt;`, or run a reloader that restarts them when the Secret changes.
- Not renewed: fix the cert-manager Certificate or issuer (its events say why), then
  restart for `http`.
- `grpc`, renewed but not loaded: fix what `grpc_tls_reload_failed` names (a key that
  does not match, a CA file without certificates); a handshake within 30 seconds loads it.
- `grpc`, renewed and no client since: the metric updates at the next connection.

## Escalation

Escalate to the identity platform owner if it is not renewed within two days, and to the
cert-manager owner if issuance fails. See
[Certificates](https://www.nauthera.io/docs/v1/installation#certificates).

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.