SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE

• Different from SEC_ERROR_EXPIRED_CERTIFICATE: there YOUR cert expired, here a CA in the chain did
• Often happens after a server migration where only cert.pem was copied, not fullchain.pem
• Inspect chain: openssl s_client -connect host:443 -servername host -showcerts
• Each block in the output is a separate certificate; for each, openssl x509 -noout -dates shows notBefore/notAfter
• Let's Encrypt: the right file is fullchain.pem (cert + intermediate), not cert.pem

# Inspect the chain and dates
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null | \
  awk '/BEGIN CERT/,/END CERT/' | csplit -z -f cert- - '/BEGIN CERT/' '{*}' >/dev/null

for f in cert-*; do
  echo "--- $f ---"
  openssl x509 -noout -subject -dates -issuer < "$f"
done

# If intermediate notAfter < today — refresh the bundle.
# nginx: ssl_certificate /path/to/fullchain.pem  (NOT cert.pem)
# Apache:
#   SSLCertificateFile     /path/to/cert.pem
#   SSLCertificateChainFile /path/to/chain.pem  (or fullchain in a single file)

• ERR_CERT_AUTHORITY_INVALID (Chrome)
• TLS handshake

The SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE error in Firefox indicates that the certificate issuer's certificate is no longer valid. To resolve this issue, ensure that your server's SSL/TLS certificate is up to date and that the certificate chain is correctly configured. You can check the certificate's validity using the command openssl s_client -connect yourdomain.com:443 -showcerts and replace any expired certificates with valid ones.

The SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE error occurs when a web browser, such as Firefox, encounters an SSL/TLS certificate that is issued by a Certificate Authority (CA) whose own certificate has expired. This can lead to security warnings, preventing users from accessing your site. The issue can stem from an outdated root certificate or an intermediate certificate that has expired.

To better understand the error, consider the following factors:

• Certificate Chain: SSL/TLS certificates are often part of a chain, where your server's certificate is linked to an intermediate certificate, which in turn is linked to a root certificate. If any of these certificates in the chain are expired, the browser will flag the entire chain as untrusted.
• Root Certificates: Browsers and operating systems maintain a list of trusted root certificates. If your issuer's root certificate is not present or is expired, users will encounter the SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE error.
• Intermediate Certificates: It is crucial to ensure that all intermediate certificates are properly installed on your server. Missing or expired intermediates can cause the browser to fail to validate your SSL/TLS certificate.

As a best practice, regularly check the certificate chain and update any expired certificates to maintain a secure connection for users.

To fix the SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE error in Firefox, follow these steps:

1. Check Your Certificate Chain: Use the following command to inspect your SSL/TLS certificate chain:

openssl s_client -connect yourdomain.com:443 -showcerts

This command will display the entire certificate chain. Look for any certificates marked as 'not valid' or 'expired'.

1. Update Expired Certificates: If you find any expired certificates, obtain updated versions from your CA. Ensure that you receive the complete certificate chain, including the intermediate certificates.

1. Install the Updated Certificates: Replace the expired certificates on your server. If you're using Apache, update your configuration file (e.g., httpd.conf or ssl.conf) with the paths to the new certificate files:

SSLCertificateFile /path/to/your_domain.crt
SSLCertificateKeyFile /path/to/your_domain.key
SSLCertificateChainFile /path/to/intermediate.crt

Restart your web server to apply the changes:

sudo systemctl restart apache2

1. Verify the Installation: After updating, verify that the new certificates are correctly installed by running the openssl command again. Ensure there are no errors in the certificate chain.

1. Clear Browser Cache: Sometimes, cached data may cause Firefox to continue displaying the error. Clear your browser cache and cookies by navigating to Settings > Privacy & Security > Cookies and Site Data > Clear Data.

By following these steps, you should successfully resolve the SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE error and restore secure access to your website for Firefox users.