# Ensure Load Balancer TLS Certificates Are Not Expired or Expiring

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826037194698-ensure-load-balancer-tls-certificates-are-not-expired-or-expiring
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the TLS certificates used by Public Cloud Load Balancer HTTPS listeners are valid and are renewed well before they expire, for example at least 30 days before the expiry date.

**Rationale**

An expired certificate makes browsers show security errors or block the site, causing outages and loss of user trust. Some clients may also stop connecting. Tracking expiry dates and renewing early keeps HTTPS working without interruption.

**Impact**

-   Avoids outages caused by expired certificates
    
-   Keeps users free of browser warnings
    
-   Certificates must be renewed and updated on the listener
    

**Default Value**

Uploaded certificates are not renewed automatically by the load balancer.

**Pre-Requisites**

-   Permission to manage the load balancer and certificates
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Load Balancer and open the load balancer's certificates (or the certificates used by its listeners).
    
4.  Check each certificate's expiry date.
    
5.  Alternatively, run: echo | openssl s\_client -connect <lb-address>:443 -servername <domain> 2>/dev/null | openssl x509 -noout -enddate
    
6.  If a certificate has expired or expires within 30 days, follow the implementation steps.
    

**Implementation Steps**

1.  Obtain a renewed certificate from your certificate authority, or generate a new Let's Encrypt certificate from the Control Panel.
    
2.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
3.  In the left-hand menu, select Public Cloud and choose your project.
    
4.  Add the new certificate and update the HTTPS listener to use it.
    
5.  Confirm that the site shows the new expiry date, then remove the old certificate.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  Update the listener to use the previous certificate if it is still valid.
    

**Reference**

-   [https://docs.ovhcloud.com/en/guides/public-cloud/network-services/load-balancer-letsencrypt](https://docs.ovhcloud.com/en/guides/public-cloud/network-services/load-balancer-letsencrypt)
    
-   [https://docs.ovhcloud.com/en/guides/public-cloud/network-services/load-balancer-concepts](https://docs.ovhcloud.com/en/guides/public-cloud/network-services/load-balancer-concepts)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.