Sev1: HTTPS broken on an OCI load balancer — expired certificate, fast replacement

#Symptoms

• Browsers show certificate expired; API clients fail TLS.

echo | openssl s_client -connect app.example.com:443 -servername app.example.com 2>/dev/null | openssl x509 -noout -dates -subject

#1. How is the listener's certificate configured?

oci lb load-balancer get --load-balancer-id $LB --query 'data.listeners'

Look at the HTTPS listener's ssl-configuration:

#2a. Certificate bundle: upload a new one and switch

oci lb certificate create --load-balancer-id $LB --certificate-name app-2026-10 \
  --public-certificate-file app.crt --private-key-file app.key --ca-certificate-file chain.crt \
  --wait-for-state SUCCEEDED

Bundles can't be edited — create a new name, then point the listener at it. listener update needs the listener's other settings too, so pass them unchanged:

oci lb listener update --load-balancer-id $LB --listener-name https \
  --default-backend-set-name bs-app --port 443 --protocol HTTP \
  --ssl-certificate-name app-2026-10 --ssl-verify-peer-certificate false \
  --force --wait-for-state SUCCEEDED

Copy every existing value (backend set, hostnames, cipher suite, rule sets, connection idle timeout) from the get output before running the update. Missing optional values may reset them.

Tip

Updating the listener through the console (Edit listener → choose the new certificate) avoids accidentally clearing other settings when you're under pressure.

#2b. OCI Certificates service

If the listener uses certificate-ids, renewal happens in the Certificates service:

• Imported certificate: import a new version of the same certificate (console: Certificates → certificate → Renew, or the oci certs-mgmt certificate update commands for imported config); the load balancer picks up the current version.
• Issued by an OCI private CA: check the renewal rule and that the CA itself hasn't expired.

oci certs-mgmt certificate get --certificate-id <cert-ocid> \
  --query 'data.{state:"lifecycle-state", current:"current-version-summary"."validity"}'

#3. Verify

echo | openssl s_client -connect app.example.com:443 -servername app.example.com 2>/dev/null | openssl x509 -noout -enddate -issuer

Check the full chain is served (missing intermediates break Java and older clients).

#Prevent it next time

• Move listeners to the OCI Certificates service so a new version applies without listener edits.
• Alarm before expiry: Certificates service emits events and metrics for upcoming expiry; route them to Notifications.
• Keep a calendar of public certificates from external CAs with owners.