{
  "id": "redis/tls-certificate-expired",
  "signature": "TLS error: certificate expired at <date>",
  "signature_zh": "TLS错误：证书已于<date>过期",
  "regex": "TLS error: certificate expired at .+",
  "domain": "redis",
  "category": "config_error",
  "subcategory": null,
  "root_cause": "The TLS certificate used by Redis (either server or client) has expired, causing the TLS handshake to fail and connections to be rejected.",
  "root_cause_type": "generic",
  "root_cause_zh": "Redis使用的TLS证书（服务器或客户端）已过期，导致TLS握手失败并拒绝连接。",
  "versions": [
    {
      "version": "6.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "7.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "7.2.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Disabling TLS entirely (e.g., port 6379 without tls-port) exposes data in transit and is not a real fix for environments requiring encryption.",
      "fail_rate": 0.6,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Setting tls-auth-clients to 'no' bypasses client certificate validation but does not fix an expired server certificate; the server certificate must be renewed.",
      "fail_rate": 0.8,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Generate a new self-signed certificate: `openssl req -x509 -newkey rsa:4096 -keyout /etc/redis/redis.key -out /etc/redis/redis.crt -days 365 -nodes` and update redis.conf with the new paths, then restart Redis.",
      "success_rate": 0.95,
      "how": "Generate a new self-signed certificate: `openssl req -x509 -newkey rsa:4096 -keyout /etc/redis/redis.key -out /etc/redis/redis.crt -days 365 -nodes` and update redis.conf with the new paths, then restart Redis.",
      "condition": "",
      "sources": []
    },
    {
      "action": "If using a CA-signed certificate, renew the certificate via your CA and replace the cert files. Use `redis-cli --tls --cert /path/to/new/cert.pem --key /path/to/new/key.pem` to test the new certificate before restarting the server.",
      "success_rate": 0.9,
      "how": "If using a CA-signed certificate, renew the certificate via your CA and replace the cert files. Use `redis-cli --tls --cert /path/to/new/cert.pem --key /path/to/new/key.pem` to test the new certificate before restarting the server.",
      "condition": "",
      "sources": []
    },
    {
      "action": "As a temporary measure, set the system clock back to a date within the certificate's validity period (not recommended for production), then restart Redis to allow connections while planning a proper renewal.",
      "success_rate": 0.4,
      "how": "As a temporary measure, set the system clock back to a date within the certificate's validity period (not recommended for production), then restart Redis to allow connections while planning a proper renewal.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "生成新的自签名证书：`openssl req -x509 -newkey rsa:4096 -keyout /etc/redis/redis.key -out /etc/redis/redis.crt -days 365 -nodes`，更新redis.conf中的路径，然后重启Redis。",
    "如果使用CA签名证书，通过CA续期证书并替换证书文件。使用 `redis-cli --tls --cert /path/to/new/cert.pem --key /path/to/new/key.pem` 在重启服务器前测试新证书。",
    "作为临时措施，将系统时钟设置回证书有效期内的日期（不推荐用于生产），然后重启Redis以允许连接，同时计划正式续期。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://redis.io/docs/management/security/encryption/",
  "official_doc_section": null,
  "error_code": "ERR",
  "verification_tier": "ai_generated",
  "confidence": 0.9,
  "fix_success_rate": 0.9,
  "resolvable": "true",
  "first_seen": "2024-01-12",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}