networking ssl_tls ai_generated true

SSL: certificate has expired

ID: networking/ssl-certificate-expired

Also available as: JSON · Markdown
95%Fix Rate
93%Confidence
75Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3 active — — —

Root Cause

The SSL/TLS certificate presented by the server has passed its expiration date. The certificate must be renewed and replaced on the server, or the client must be configured to trust a new certificate.

generic

Workarounds

  1. 95% success Renew the SSL certificate using the original CA or a new provider 
    1. Generate a new CSR: openssl req -new -key server.key -out server.csr
2. Submit CSR to your CA (Let's Encrypt, DigiCert, etc.) for renewal
3. Install the new certificate on the server
4. Restart the web server / application
5. Verify with: openssl s_client -connect host:443 | openssl x509 -noout -dates
  2. 92% success Set up automatic certificate renewal with Let's Encrypt and certbot 
    1. Install certbot: apt install certbot
2. Obtain cert: certbot certonly --webroot -w /var/www/html -d yourdomain.com
3. Enable auto-renewal: systemctl enable certbot.timer
4. Test renewal: certbot renew --dry-run
5. Add post-renewal hook to restart your server in /etc/letsencrypt/renewal-hooks/deploy/
  3. 88% success For internal services, regenerate a self-signed certificate with a longer validity period 
    1. Generate new self-signed cert: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
2. Deploy the new cert to the server
3. Distribute the new cert to all clients that need to trust it
4. Restart the service

Dead Ends

Common approaches that don't work:

  1. Set system clock back to before certificate expiry 95% fail

    This is a temporary hack that creates far worse problems: log timestamps become invalid, cron jobs misfire, Kerberos auth breaks, and the certificate will still appear expired to remote clients performing their own time validation.

  2. Disable SSL certificate verification globally in the client application 80% fail

    While this suppresses the error, it completely defeats the purpose of TLS by allowing man-in-the-middle attacks. It also masks other certificate issues and creates a security vulnerability that is easy to forget to revert.

  3. Downgrade OpenSSL to an older version that is more lenient with expired certs 90% fail

    Older OpenSSL versions have known security vulnerabilities (e.g., Heartbleed). The expired certificate is still expired regardless of client version, and modern servers may reject connections from outdated TLS implementations.

Error Chain

Leads to:
Preceded by:
Frequently confused with: