mTLS certificate expired

At 00:00 UTC, every service-to-service call to the internal 'identity' service starts failing with TLS handshake errors ('certificate has expired'), and login across the whole platform breaks. There was no deploy. Identity's own pods are up and healthy on their dashboards; the failures are all on the client side of mTLS. A cert-rotation automation that normally renews internal certs 30 days early logged a failure 31 days ago that nobody acted on. Triage and mitigate.