ResolvedMajor impact
Convoy API outage — expired edge TLS certificate
- Started
- 8 Oct 2026, 16:13 UTC
- Duration
- 18m
- Affected components
- Convoy API
Updates
Investigating
Convoy API (convoy.tktchurch.net) is unreachable since ~21:43 IST. The API itself is healthy; the edge TLS certificate expired and strict clients fail to connect. Investigating certificate renewal.
Resolved
Resolved. Certificate renewed (valid to Jan 2027), API healthy, board green. Token rotated vault-side and fleet-wide except the CRM host (no access — tracked). TLS-expiry early warning (30d warn / 14d page) added to the status watcher so renewal failures page weeks before expiry.
Identified
Root cause: the Cloudflare API token used by Traefik for ACME DNS challenges is scoped to tktchurch.com only and cannot touch tktchurch.net, so every .net renewal failed. A new token covering both zones has been minted and proven. Rolling it out fleet-wide.