Expired TLS certificate on annotationapi.pyronear.org

Summary

The production annotation API endpoint https://annotationapi.pyronear.org is serving an expired Let's Encrypt certificate, breaking all TLS-verifying clients.

Evidence

$ echo | openssl s_client -connect annotationapi.pyronear.org:443 -servername annotationapi.pyronear.org 2>/dev/null | openssl x509 -noout -subject -issuer -dates
subject=CN = annotationapi.pyronear.org
issuer=C = US, O = Let's Encrypt, CN = R13
notBefore=Apr  9 13:15:55 2026 GMT
notAfter =Jul  8 13:15:54 2026 GMT

The certificate expired on 2026-07-08 (~9 days ago as of 2026-07-17).

Impact

• Any HTTPS client that verifies certificates fails with SSLError(SSLCertVerificationError: certificate has expired).
• The data-transfer scripts that talk to the remote (make pull-sequences, make pull-seq-annotations, make push-annotations) cannot authenticate or connect.
• The only current workaround is disabling TLS verification, which is insecure and should not be a standing practice.

Reproduce

make pull-sequences MAX_SEQUENCES=5 READ_ONLY_SOURCE=1
# -> Source annotation auth failed: SSLError(... certificate has expired ...)

Suggested fix

• Renew/redeploy the Let's Encrypt certificate on annotationapi.pyronear.org (the auto-renewal / certbot hook likely failed silently).
• Add expiry monitoring/alerting so this is caught before expiration next time.

Start by checking the certificate renewal and deployment setup for annotationapi.pyronear.org, including the suspected certbot renewal hook. Reproduce the failure with the documented openssl command and make pull-sequences MAX_SEQUENCES=5 READ_ONLY_SOURCE=1; done means the endpoint serves a current trusted certificate and the affected transfer commands connect without disabling TLS verification.