Summary

Multiple services went down for 22 minutes due to an expired SSL certificate. Nginx Proxy Manager failed to auto-renew because the DNS challenge was still configured for Route53 instead of Cloudflare.

Affected services:
- plex.kitzy.net
- overseerr.kitzy.net
- unifi.kitzy.net

Timeline

• 10:12pm EST - SSL errors detected across all monitoring regions
• 10:13pm EST - Incident triggered, alert sent
• 10:34pm EST - Service restored
• 10:35pm EST - Incident resolved

Total downtime: 22 minutes

Root cause

When I migrated DNS from Route53 to Cloudflare months ago, I didn't update the DNS challenge credentials in Nginx Proxy Manager. NPM continued trying to use Route53 for Let's Encrypt renewals, which failed silently until the cert expired.

Resolution

Updated NPM's DNS challenge configuration to use Cloudflare API credentials. Certificate renewed successfully.

Future Prevention

• Document DNS provider changes in a checklist that includes updating NPM
• Set up monitoring for upcoming certificate expirations (30-day warning)
• Review all automation that depends on DNS provider credentials when switching providers

Plex, Overseer, and Unifi Controller recovered.

Overseer and Unifi Controller went down.

Plex went down.