What happened

On the evening of August 31, users began getting "something went wrong" errors in Outlook on the web and the desktop client, then sign-in failures across Teams and SharePoint. Microsoft's first status message said only that it was "investigating reports of Exchange Online issues." A later update narrowed it: "We've identified an issue with an authentication component which is contributing to impact. To address this, we've developed a remediation strategy and we're applying it to a portion of infrastructure to test its efficacy."

Community reporting, including Günter Born's write-up and administrator screenshots, showed error text of the form "The cert with thumbprint 19F04B8A… is expired." Microsoft's own wording stayed at "core authentication configuration," so treat the expired-certificate root cause as strongly indicated by the errors rather than formally confirmed by the vendor.

Recovery was slow because the remediation had to be rolled out infrastructure by infrastructure. Microsoft closed EX1464935 and the related MO1465074 as resolved after telemetry showed services healthy from September 3, 10:00 UTC. OpenAI was among the customers publicly reported as affected.

Why it matters if you run public infrastructure

The interesting part is not that Microsoft made a mistake. It is that the organization with the most PKI expertise and tooling on the planet still had one certificate whose expiry date was not on anyone's calendar, and that certificate happened to sit under authentication for half a dozen products. Certificate expiry is not a "small teams" problem. It is a coverage problem: the certificate you forgot is, by definition, the one your process did not know about.

Three things make this failure mode worse in 2026 than it was five years ago:

  • Lifetimes are shrinking. Public TLS certificates are capped at 200 days today, 100 days from March 2027 and 47 days from March 2029. More renewals per year means more chances for one to silently stall.
  • Blast radius has grown. A single certificate on a shared authentication layer, an API gateway or a load balancer now fronts many services. The outage does not look like a certificate problem to the people it hits, which is why Microsoft's first message talked about Exchange, not certificates.
  • Automation hides the manual ones. When 95 percent of certificates renew via ACME, the remaining 5 percent (appliances, internal PKI, anything issued by hand) stop being anyone's routine.

What to check this week

  1. Inventory what you actually serve, not what you think you serve. Enumerate every hostname answering on 443 and on custom ports (8443, 9443, mail ports, admin UIs) and record the expiry of the certificate each one presents. Certificate transparency logs will show you certificates you issued; only a live probe shows you which one is actually deployed.
  2. Find certificates that should have renewed and did not. An automated renewal that fails quietly looks fine until the deadline. If a certificate is past two thirds of its lifetime and the served certificate has not changed, something is stuck.
  3. Check the ones nobody owns. Load balancers, SSO gateways, VPN concentrators, SMTP with STARTTLS, and anything a vendor installed. Ask who gets paged when each expires.
  4. Set alerts at 30, 14 and 7 days, to a channel someone reads. Microsoft's outage lasted days partly because remediation had to be tested and staged. Your fix is faster, but only if you learn about it before the expiry, not from customers.

How Attack Surface Scan covers this

Attack Surface Scan probes the certificate every hostname on your verified domains actually serves, on 443 and on the custom ports you add, daily or every 6 hours depending on plan. It alerts on approaching expiry and flags stalled renewals: a served certificate that is past the point where an automated renewal should have replaced it. Discovery from certificate transparency logs adds hostnames you forgot to list, which is the category this outage came from. It cannot see a purely internal authentication certificate like Microsoft's, and no external scanner can; what it does is remove the "we did not know that host existed" class of expiry.

Sources