Description

Ensure the TLS certificates used by Public Cloud Load Balancer HTTPS listeners are valid and are renewed well before they expire, for example at least 30 days before the expiry date.

Rationale

An expired certificate makes browsers show security errors or block the site, causing outages and loss of user trust. Some clients may also stop connecting. Tracking expiry dates and renewing early keeps HTTPS working without interruption.

Impact

  • Avoids outages caused by expired certificates

  • Keeps users free of browser warnings

  • Certificates must be renewed and updated on the listener

Default Value

Uploaded certificates are not renewed automatically by the load balancer.

Pre-Requisites

  • Permission to manage the load balancer and certificates

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Load Balancer and open the load balancer's certificates (or the certificates used by its listeners).

  4. Check each certificate's expiry date.

  5. Alternatively, run: echo | openssl s_client -connect <lb-address>:443 -servername <domain> 2>/dev/null | openssl x509 -noout -enddate

  6. If a certificate has expired or expires within 30 days, follow the implementation steps.

Implementation Steps

  1. Obtain a renewed certificate from your certificate authority, or generate a new Let's Encrypt certificate from the Control Panel.

  2. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  3. In the left-hand menu, select Public Cloud and choose your project.

  4. Add the new certificate and update the HTTPS listener to use it.

  5. Confirm that the site shows the new expiry date, then remove the old certificate.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. Update the listener to use the previous certificate if it is still valid.

Reference