A Forgotten Certificate Took Down Microsoft 365, and That's the Real Story
An expired internal certificate took down Microsoft 365 for hours, a reminder that certificate lifecycle management matters at any size business.
Microsoft 365 went down again right at the end of August, and this time the cause is worth sitting with: an internal security certificate simply expired. According to TechCrunch and a detailed writeup from Born’s Tech and Windows World, the outage started around 7:05 p.m. CET on August 31 and rolled into September 1, taking down Exchange Online, Outlook, Teams, SharePoint, and parts of the admin console along the way. It affected large organizations broadly, reportedly including OpenAI.
The cause, in plain terms. Every secure connection on the internet relies on digital certificates that prove a service is who it says it is, and those certificates expire on a schedule, the same way a driver’s license does. Someone or something is supposed to renew them before that happens. This time, that didn’t happen, and the expired certificate broke authentication across a wide swath of Microsoft’s own infrastructure.
Why this is more relatable than it sounds. This is not an exotic attack or a novel vulnerability. It’s a missed renewal, the kind of thing that happens on internal systems at businesses of every size, all the time. Microsoft has enormous engineering resources and it still happened to them. That’s not a knock on Microsoft specifically, it’s a reminder that certificate expiration is a boring, unglamorous risk that doesn’t get attention until it causes an outage.
General IT Tip: Know Every Certificate You Have, and When It Expires
Most businesses can name their domain’s SSL certificate, but internal systems, VPNs, internal websites, and integrations often have certificates nobody’s tracking closely. A simple inventory, even a spreadsheet, with expiration dates and calendar reminders well before each one, prevents this exact kind of self-inflicted outage. If you use a monitoring or RMM tool that can track certificate expiration automatically, that’s a better long-term answer than a spreadsheet, but a spreadsheet beats nothing.
What This Means for You
- Take an inventory of certificates in your environment, not just the obvious public-facing ones.
- Set renewal reminders well ahead of expiration, not on the expiration date itself.
- If you have monitoring tooling that can alert on upcoming certificate expiration, turn that feature on. If you don’t, this is a good reason to look into it.
Sources: