Every certificate was valid. The authority underneath them had six days left

Background

The trigger was trivial: a browser certificate warning on an internal hostname. That turned out not to be a fault at all — the public name resolves to the LAN gateway on this host, so the browser was being shown the internal certificate instead of the public one, exactly as configured. Checking why exposed the real condition. Four leaf certificates covering the gateway, GitLab, ArgoCD and object storage all reported validity into September. The internal authority that signed them expired in six days. cert-manager had already rotated to a newer authority, but no leaf had been re-issued against it, so every one of them was still chained to the one about to lapse.

Path

Symptom

a browser certificate warning on an internal hostname

Assumption

assumed a misconfigured or expired certificate

Measurement

compared the leaf expiry against the authority that signed it

Decision

replaced the trust anchor before re-issuing, and proved it with a real build

Response

Ordering was the whole problem. The build pipeline carried that same authority as its trust anchor for pushing images, so re-issuing the certificates first would have left every build unable to verify the registry. The trust anchor was replaced first with a bundle containing both the old and new authority, so both paths validated during the transition; only then were the certificates re-issued, and a real pipeline was run because that is the only check capable of proving the first step worked. Renewing first and fixing trust afterwards would have looked correct at every individual step and broken delivery entirely.

Skill upgrade