Even though our certificate was scheduled to renew automatically, it was not done because of a missing DNS record. Cloudfront was affected because it actively checks for SSL certificate validity. Fastly was not affected as it was not checking SSL certificate validity.

We have put checks which will now proactively notify us of any such expiring SSL certificate.

Our image processing service shares SSL certificates across all regions. That certificate expired causing SSL connections from CloudFront to error. We have quickly mitigated it by updating the certificate.

All uncached image requests from Cloudfront CDN failed. Cached images and Fastly CDN were unaffected.