MTLS Outage with Delegates

What to do

• Check whether you use Harness Continuous Delivery - Next Generation (CDNG), Continuous Delivery - Next Generation (CDNG), Continuous Delivery - Next Generation (CDNG). Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 8h 28m it lasted.

  Anything that failed between 2026-09-14 19:00 UTC and 2026-09-15 03:28 UTC may need a replay.

• Subscribe to Harness's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=harness works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Harness 6

1. investigatingSep 14, 2026, 7:00 PM UTC

   We are currently investigating this issue.

   provider

2. identifiedSep 15, 2026, 12:42 AM UTC

   The issue has been identified and a fix is being implemented.

   provider

3. identifiedSep 15, 2026, 12:45 AM UTC

   We are continuing to work on a fix for this issue.

   provider

4. monitoringSep 15, 2026, 1:46 AM UTC

   A fix has been implemented and we are monitoring the results.

   provider

5. resolvedSep 15, 2026, 3:28 AM UTC

   This incident has been resolved.

   provider

6. postmortemSep 21, 2026, 6:26 PM UTC

   # **Summary** To improve the security posture, On September 14, 2026, Harness performed a scheduled rotation of the TLS certificate used to secure Delegate connections for accounts using mutual TLS \(mTLS\),The replacement certificate passed Harness's existing pre-deployment validation and smoke testing. However, the rotation also introduced a change in certificate authority, which required additional certificate-chain and gateway configuration this prevented affected Delegates from connecting to Harness. Harness has identified the contributing factors and is implementing the corrective actions described below to prevent a recurrence. # **Impact** Delegates configured to use mutual TLS in Prod environment were unable to connect to Harness for until Harness applied a temporary mitigation \(disabling mTLS\) that restored connectivity while the underlying issue was corrected. This affected the ability to run pipelines and other operations dependent on the affected Delegates. Full, permanent connectivity — with mTLS restored to its normal, fully secure configuration — was confirmed for both environments by 7:20 PM PST. # **Root Cause** ‌ As part of routine certificate maintenance, Harness rotated the certificate used by the gateway component that secures mutual TLS connections for Delegates in prod environments. The rotation also introduced a change in certificate authority, which required additional certificate-chain and gateway configuration that was not fully covered by the existing validation process. As a result, the gateway was unable to load the new certificate correctly, and Delegates relying on mutual TLS could not establish a secure connection. # **Remediation** Once the certificate rotation was confirmed as the source of the issue, Harness engineering worked continuously to correct the certificate and validate the fix with Citi before fully restoring the secure configuration. Corrective and Preventive Actions During remediation, Harness also identified and corrected a secondary issue with the replacement certificate's chain, which required an additional deployment before connectivity was fully and permanently restored. # **Next Steps** Harness is taking the following steps to prevent a recurrence of this issue: 1. Extend pre-deployment validation and smoke testing to explicitly cover certificate authority changes and full certificate-chain verification, closing the specific gap that allowed this configuration through. 2. Enhance automation for managing mTLS-related configuration changes, 3. Improve monitoring and alerting for Delegate connectivity, including account-level visibility, so similar issues are detected automatically

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.