Help: ZPA connector certificate renewal process is failing silently.

Alright, who else has had their ZPA connectors quietly give up the ghost because the certificate renewal decided to take an unscheduled vacation?

We've got a pair of connectors in an auto-scaling group, supposedly set to auto-renew certificates. Monitoring showed them "healthy" in the ZPA admin portal, but application segments started timing out. Logs on the connector VMs showed the service running, but no active tunnels. The culprit? Expired machine certificates. The auto-renewal process failed without updating the portal status or throwing a useful error.

- Connector status in admin portal: **Green/Healthy**
- Actual certificate validity: **Expired 5 days ago**
- Log entries: Just generic heartbeats, no renewal attempts or failures.

Had to manually SSH in and run the renew command, which finally spit out a vague error about being unable to reach the provisioning service (network paths were fine). A forced re-provisioning via `sudo -E /opt/zscaler/var/service-connector/bin/start.sh -p` eventually worked.

So my questions for the room:

1. What's the *actual* failure mode for your auto-renewal? Is the cron job broken, or does it silently fail when the connector can't phone home?
2. Has anyone built reliable external monitoring for this? Checking the cert file directly, perhaps?
3. ZPA's health check seems to be a simple process check, not a certificate validity check. Are we all just expected to accept this as a "feature"?

The lack of visibility into a core lifecycle process for a *security* product is... well, let's call it ironic.

- Nina