Certificate expiry is one of those IT problems that’s entirely preventable, and yet still catches businesses out on a regular basis. We recently worked through exactly this scenario: a client’s NPS Extension for Azure MFA stopped authenticating VPN users overnight, with no warning beyond a vague connection error on the user’s end.

The root cause was a certificate tied to the NPS Extension’s authentication chain that had quietly expired. Nobody had been actively monitoring it, because it isn’t the kind of thing that shows up in day-to-day system checks, it simply works until the day it doesn’t. Diagnosing it took longer than fixing it: by the time the actual cause was identified, every affected user had already been locked out of remote access for the morning.

This is a useful case study in a broader point: a lot of “silent” infrastructure dependencies, certificates, service accounts, scheduled tasks, expire or fail without any proactive alerting unless someone has specifically configured monitoring for them. MFA infrastructure is a particularly painful place for this to happen, because the symptom (users can’t log in) looks identical to a dozen other unrelated problems, and troubleshooting starts from the wrong end entirely if certificate expiry isn’t on the checklist.

The fix going forward isn’t complicated: certificate expiry monitoring with advance warning (30, 14, and 7 days out is a reasonable cadence), documented renewal procedures so it isn’t tribal knowledge sitting with one person, and a habit of treating authentication infrastructure with the same monitoring rigour as production servers.

If you’re not entirely sure what certificates your authentication chain depends on, or when they expire, it’s worth finding out before it finds you. Get in touch if you’d like us to audit your MFA and authentication infrastructure for exactly this kind of blind spot.