What happened
- On December 6, 2018, outages affected O2 and SoftBank customers.
- Ericsson said "expired software certificates" on its equipment caused the outage.
- Ericsson said: "Ericsson takes full responsibility for this technical failure".
- Reporting described the scale as "millions of customers".
This was a certificate in telecom core software, not a public website certificate. The lesson that carries over is that expired certificates cause outages and that expiry should be monitored.
Root cause, per the sources
Per Ericsson, expired software certificates on its equipment.
The exposure behind it
Certificates have fixed end dates. If nobody tracks them, an expiry arrives as a surprise. For public websites, the expiry date is visible from outside.
What PixelPrivate can check
Certificate expiry checks
We flag expiring and expired certificates on your public hosts, for example "Certificate expires in N days".
Learn moreWhat PixelPrivate cannot do
- PixelPrivate does not detect intrusions, fraud or active attacks. It performs passive external checks and reports exposures.
- We only see certificates on public hosts. We cannot see certificates inside internal systems or vendor equipment, which is where this incident happened.
- We cannot claim that PixelPrivate would have prevented this incident, and we do not claim that.
What to do this week
- List every certificate your business depends on, public and internal.
- Assign an owner and a renewal reminder to each one.
- Prefer automated renewal where your provider supports it.
- Ask critical vendors how they track certificate expiry.
Sources
- TechCrunch, “Here's what caused yesterday's O2 and SoftBank outages”, Dec 7, 2018. https://techcrunch.com/2018/12/07/heres-what-caused-yesterdays-o2-and-softbank-outages
Last reviewed 2026-10-06. Figures are quoted as reported by the cited source.
Related hypothetical scenarios
Questions about this incident
Was this a website certificate?
No. It was a certificate in telecom core software, so it does not show what happens to a public website certificate.
Who took responsibility?
Ericsson said it takes full responsibility for this technical failure.
Does PixelPrivate monitor internal certificates?
No. It flags expiring and expired certificates on public hosts only.
