Cribl: Expired Certificates on LogStream Cloud Workers
Timeline of updates
- resolved
January 21, 2022 | 07:49PM We have identified the issue and a path forward. If you are not using TLS sources WITH certificate validation you do not need to take any action at this time. If you are sending data to LogStream in Cribl.Cloud to a TLS source AND you have certificate validation enabled you will need to take the following actions to load your new certificates and to resume data collection: 1. Deploy the new certificates to you worker - In the left navigation choose "Configure" - At the top right click "Deploy" then "Deploy" in the modal 2. Restart your worker to pick up the changes - In the left navigation choose "Workers" - Expand your workers by click ">" - Restart workers by clicking Restart A broader update to Cribl.CLoud is in process to prevent this issue in the future. The above steps will provide immediate remediation if there is an interruption to your TLS sources. January 21, 2022 | 06:32PM The Cribl Cloud Ops team is looking into an issue where TLS/SSL certificates on Cloud Workers have expired on a subset of our user population. This would only impact users who have sources setup to send data to Cloud Workers using TLS and that actually validate the certificate details. If you are not doing this then you would still be able to access your Cloud LogStream instance and any other sources would still be sending data successfully. Another update will be posted soon.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.
Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).