Page 34: The default setting for this device allowed web traffic to continue through to the ACIS system, even when the SSL certificate was expired. When this occurs, traffic flowing to and from the internet is not analyzed by the intrusion detection or prevention systems because these security tools cannot analyze encrypted traffic.

Spitballing here based on my experience in the field but without any specific knowledge about Equifax's situation:

Their monitoring system might have been using TLS to communicate the events to their aggregation tool, and when the cert expired, you don't really want log data with potentially confidential/critical security information traversing insecure channels, so they may have had it configured to not send any data if the cert wasn't valid.

As for warnings about the cert, it's possible they (stupidly) configured it to not send warnings, or maybe it was sending warnings but nobody was paying attention. I've seen situations before where such warnings were set to go to XYZ person's mailbox, but XYZ person leaves the company and nobody remembered to update the destination address for the alerts.

My guess is that they were using private certificates to read encrypted data, without which they couldn't inspect their traffic.

The exfiltration attempt would have likely been triggered on volume alone. Possibly it was simply a service that could not longer connect due to a lapsed cert trying to raise the alarm.

(speculation) It could be that the expired certs were on the ingestion side. The monitoring agents tried to report something to the central place, but failed due to expired cert on the TLS connection. No other monitoring picked up that new data is not incoming.

Uniformed speculation, but I imagine the monitoring device sends warnings and such to a central SIEM/log server (like splunk) for analysis and correlation across multiple devices. That channel is likely web server calls or json posts, over https.

Maybe the cert on the web server was updated, but the private key for the updated cert was never copied to the SSL Visibility Appliance?