# TLS error: certificate expired at <date>

- **ID:** `redis/tls-certificate-expired`
- **Domain:** redis
- **Category:** config_error
- **Error Code:** `ERR`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The TLS certificate used by Redis (either server or client) has expired, causing the TLS handshake to fail and connections to be rejected.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 6.0.0 | active | — | — |
| 7.0.0 | active | — | — |
| 7.2.0 | active | — | — |

## Workarounds

1. **Generate a new self-signed certificate: `openssl req -x509 -newkey rsa:4096 -keyout /etc/redis/redis.key -out /etc/redis/redis.crt -days 365 -nodes` and update redis.conf with the new paths, then restart Redis.** (95% success)
   ```
   Generate a new self-signed certificate: `openssl req -x509 -newkey rsa:4096 -keyout /etc/redis/redis.key -out /etc/redis/redis.crt -days 365 -nodes` and update redis.conf with the new paths, then restart Redis.
   ```
2. **If using a CA-signed certificate, renew the certificate via your CA and replace the cert files. Use `redis-cli --tls --cert /path/to/new/cert.pem --key /path/to/new/key.pem` to test the new certificate before restarting the server.** (90% success)
   ```
   If using a CA-signed certificate, renew the certificate via your CA and replace the cert files. Use `redis-cli --tls --cert /path/to/new/cert.pem --key /path/to/new/key.pem` to test the new certificate before restarting the server.
   ```
3. **As a temporary measure, set the system clock back to a date within the certificate's validity period (not recommended for production), then restart Redis to allow connections while planning a proper renewal.** (40% success)
   ```
   As a temporary measure, set the system clock back to a date within the certificate's validity period (not recommended for production), then restart Redis to allow connections while planning a proper renewal.
   ```

## Dead Ends

- **** — Disabling TLS entirely (e.g., port 6379 without tls-port) exposes data in transit and is not a real fix for environments requiring encryption. (60% fail)
- **** — Setting tls-auth-clients to 'no' bypasses client certificate validation but does not fix an expired server certificate; the server certificate must be renewed. (80% fail)