IC0.app and icp0.app expired

Developers
1

The IC’s HTTP gateway, the thing that serves every *.ic0.app and *.icp0.io address, is presenting an expired certificate across at least three nodes in two networks. Is there a scheduled outage? Internet identity and NNS probably are affected or did they change?

2

the team is aware and working on it. (cc @rbirkner)

it is an issue for all ic domains as they are all covered by the same cert. the only thing still working are the custom domains.

thanks for reporting!

3

Hey @MeneseProtocol

Thanks a lot for your report! This is not a planned downtime, but an outage. The main certificates on the HTTP loadbalancers, part of the boundary node architecture, expired. Custom domains were not affected as their certificates are managed differently.

In the meantime, all access has been restored.

We apologize for the issues caused and will follow up with more details.

4

Today between roughly 11:21 UTC and 11:45 UTC (2026-08-03) the HTTP gateway nodes reachable from my route were serving an expired TLS certificate, making all *.icp0.io and *.ic0.app frontends unreachable from here (browsers showed “connection is not private” / NET::ERR_CERT_DATE_INVALID).

Evidence collected during the incident:

  • Certificate served: CN=ic0.app, issuer Let’s Encrypt E7, notAfter = Aug 3 11:21:45 2026 GMT — i.e. the nodes kept serving it after expiry instead of a renewed one.
  • Boundary IPs my route resolved to (both serving the expired cert): 209.34.235.18 and 23.236.116.77.
  • Same expired cert observed on icp0.io, ic0.app, raw.icp0.io and icp.net from this vantage point, so it was the node, not one domain.
  • Meanwhile, resolving icp0.io via Google/Cloudflare DoH returned 208.115.197.139, which was serving a renewed certificate (notAfter Oct 6 2026) — and external
    vantage points loaded my dapp fine. So this was route/POP-specific, which is presumably why status.internetcomputer.org stayed green (“All Systems Operational”) the
    whole time.
  • Vantage point: Sydney, Australia, AS4764 (Aussie Fibre).

By ~11:45 UTC my route was back on a healthy node and everything works again.

Reporting because a per-edge renewal miss like this is invisible to global monitoring but takes a whole region’s users offline for the duration — might be worth checking why those two nodes didn’t pick up the renewed cert at rollover, and whether edge cert expiry is alarmed per-node.

Happy to provide more details if useful.

5

Thank you @rbirkner and @marc0olo for the quick follow up everything is back to normal.

6

thanks @rbirkner and @marc0olo everything is working now

7

THANKS @marc0olo , @rbirkner And @MeneseProtocol for reporting and DFINITY for acting timely