tls.check-local-certificate-expiry

check_local_certificate_expiry

Enables local leaf certificate expiry checks for outbound TLS operations. Set this independently in each backend's tls block.

tls {
    certificate "CLIENT_CERTIFICATE";
    certificate_key "CLIENT_KEY";
    check_local_certificate_expiry true;
}

Accepts true or false. The default is false, preserving connection attempts without a local expiry check. Setting certificate-expiry-grace-period alone does not enable checking.

Set true to block expired local credentials. The allowance defaults to 0s when checking is enabled; configure a positive grace period only when you intend to permit attempts with expired credentials for that duration.

The check applies to all configured outbound TLS connections. A client without a configured local certificate is unaffected. TLS server certificates are unaffected. Existing open transports are not disconnected solely because their local certificate expires.

When enabled, separate diagnostic messages identify blocked attempts and expired credentials allowed by a positive grace period. When disabled, this policy neither rejects attempts nor emits its expiry diagnostics. Peer certificate verification continues to apply in both cases.