TLS certificate expired

An internal API that other teams call started returning connection failures at 2:00am exactly. The callers' logs show TLS handshake errors mentioning an expired certificate, and browsers hitting the endpoint show a 'certificate expired' warning. The service process itself is up and healthy; only the TLS layer is failing. Nothing deployed recently. How do you confirm the cause and restore service?