Certificate Has Expired in curl, Node.js and OpenSSL: Find Which One and Fix It

The text is OpenSSL verification error 10, X509_V_ERR_CERT_HAS_EXPIRED: «The certificate has expired: that is the notAfter date is before the current time» (X509_STORE_CTX_get_error). The check runs for every certificate in the chain OpenSSL builds, not only for the server's own, and «current time» is the clock of the machine doing the verifying.

You will see it as curl: (60) SSL certificate problem: certificate has expired, as Error: certificate has expired with code: 'CERT_HAS_EXPIRED' in Node.js (X509 error codes), and as certificate verify failed: certificate has expired in Python. Its mirror image is error 9, certificate is not yet valid, which you get when the client clock is behind the certificate's notBefore date.

Browsers show the same condition as NET::ERR_CERT_DATE_INVALID. This page is about scripts, APIs, CI jobs and devices, where the expired certificate is often not the one you think.

The cross-signed root case is the one that surprises people. On 30 September 2021 Let's Encrypt's DST Root CA X3 cross-sign expired. Let's Encrypt warned that API clients must trust ISRG Root X1 and, if they use OpenSSL, must run version 1.1.0 or later, because «in OpenSSL 1.0.x, a quirk in certificate verification means that even clients that trust ISRG Root X1 will fail» with the compatible chain (Let's Encrypt). Old embedded devices and containers built on old base images showed exactly this error while the site was perfectly valid.

A renewed certificate that is not being served is the other classic: Certbot renewed the file on disk, but nginx keeps the old certificate in memory until it is reloaded.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>&1 | grep -E '^depth|verify error'
depth=1 C = US, O = Example CA, CN = Example Intermediate
verify error:num=10:certificate has expired

The depth line just before the error names the culprit: 0 is the server's certificate, 1 and above are the chain. To print every certificate the server sends with its dates:

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null > chain.pem
openssl storeutl -noout -text -certs chain.pem | grep -E 'Subject:|Not After'

Then check the client side: date -u and timedatectl on Linux. A device whose clock reset to a factory date after a power cut fails with error 9 or 10 on every site.

1. Fix the clock first if it is wrong: enable NTP (timedatectl set-ntp true) and re-test. Nothing else matters until the time is right.
2. Leaf expired: renew it (certbot renew or your CA's process), then reload the server: nginx -t && systemctl reload nginx. With Certbot, a --deploy-hook "systemctl reload nginx" makes the reload automatic. Check that every node behind the load balancer serves the new certificate.
3. Intermediate expired: download the current chain from your CA (or use the fullchain.pem your ACME client just wrote) and replace the old chain file. A stale chain file copied years ago is the usual source.
4. Client trust store outdated: update the bundle (apt-get install --only-upgrade ca-certificates, a newer base image, a newer runtime). On clients still on OpenSSL 1.0.x, upgrade OpenSSL; that is the Let's Encrypt failure mode.
5. Keep it from coming back: monitor expiry dates of the leaf and the chain, not just whether the site loads today.

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
notAfter=Jan 15 12:00:00 2027 GMT
curl -sS -o /dev/null -w '%{http_code} verify=%{ssl_verify_result}\n' https://example.com/
# 200 verify=0

Run the check against each server address if you have several. The SSL/TLS checker shows the expiry of the certificate your site serves and flags problems in the chain it sends.

• NET::ERR_CERT_DATE_INVALID — the same condition in Chrome and Edge
• SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE — Firefox, expired intermediate
• unable to get local issuer certificate — the chain cannot be completed at all
• self-signed certificate in certificate chain — untrusted root
• Expired SSL certificate — renewal walkthrough
• How to rotate an SSL certificate — without downtime