[CRITICAL] TLS certificate for picoclaw.io expired on 2026-09-10 — site is down for every browser

Summary

The TLS certificate served by https://picoclaw.io (the project homepage linked from this repo) expired on 2026-09-10 23:59:59 UTC. Every browser and every TLS client now refuses the connection, so the site is effectively down for all visitors.

This is time-sensitive: the longer it stays expired, the more visitors hit a full-page security warning on the project's front door.

Evidence

Checked 2026-09-12 14:11 UTC:

$ echo | openssl s_client -connect picoclaw.io:443 -servername picoclaw.io | openssl x509 -noout -subject -issuer -dates
subject=CN=picoclaw.io
issuer=C=US, O=Amazon, CN=Amazon RSA 2048 M04
notBefore=Feb 25 00:00:00 2026 GMT
notAfter=Sep 10 23:59:59 2026 GMT

$ curl -sS https://picoclaw.io/
curl: (60) SSL certificate problem: certificate has expired

With verification disabled the origin still answers 200, so the content is fine — only the certificate is broken:

$ curl -sk -o /dev/null -w "%{http_code}\n" https://picoclaw.io/
200

Where to look

• The issuer is Amazon RSA 2048 M04 and the A records point at CloudFront (13.224.245.x), so this is an AWS ACM certificate attached to a CloudFront distribution.
• ACM only auto-renews when its DNS or email validation is still passing. A 6-month-plus certificate that silently lapsed usually means the validation CNAME was removed or the domain's DNS moved — check the certificate's status in ACM (us-east-1, since CloudFront requires that region) for a "Pending validation" / "Failed" renewal.
• Fix is either restoring the validation record so ACM re-issues, or requesting a new ACM certificate and attaching it to the distribution.

Side note

www.picoclaw.io has no DNS record at all, so https://www.picoclaw.io fails for a different reason (NXDOMAIN). Not urgent, but worth a CNAME once the certificate is sorted.