tls.certificate-expiry-grace-period

certificate_expiry_grace_period

Limits the time after expiry during which an outbound TLS operation may use its configured local leaf certificate when check-local-certificate-expiry is enabled. Set this independently in each backend's tls block.

tls {
    certificate "CLIENT_CERTIFICATE";
    certificate_key "CLIENT_KEY";
    check_local_certificate_expiry true;
    certificate_expiry_grace_period 0s;
}

The default is 0s. Enable check_local_certificate_expiry to block expired local credentials with this default allowance. The allowance has no effect while checking is disabled, which is the default. A positive value permits attempts within that allowance for compatibility; it does not make the certificate valid. Peers performing certificate validity checks should reject it, but their verification policy may differ.

Accepts a nonnegative duration, including fractional durations. Unsuffixed values are milliseconds. The expiry instant and the exact allowance boundary are inclusive; operations after that boundary are blocked. Expiry comparisons use absolute timestamps; diagnostic timestamps follow the configured log time zone.

The check applies to all configured outbound TLS connections. It checks the local leaf certificate, rather than certificate age since issuance or remote certificate validity. A client without a configured local certificate is unaffected. TLS server certificates are unaffected. Existing open transports are not disconnected solely because their local certificate expires.

Blocked attempts and attempts allowed with an expired certificate have separate diagnostic messages containing the certificate name, expiry time, elapsed time since expiry, and configured allowance. Repeated diagnostics follow the configured logging promotion policy. Renew the certificate to restore validity; this option does not disable peer certificate verification.