verify error:num=10:certificate has expired

s_client prints "verify error:num=10:certificate has expired" followed by "notAfter=…"; openssl verify prints "error 10 at <depth> depth lookup: certificate has expired". Certificates that are not valid yet give error 9, "certificate is not yet valid".

OpenSSL CLI (openssl s_client / openssl verify) — X509_V_ERR_CERT_HAS_EXPIRED

What it means

OpenSSL error 10 (X509_V_ERR_CERT_HAS_EXPIRED): a certificate in the chain has a notAfter date in the past relative to the verification time, which is the local clock unless -attime is given. The depth line printed together with the error tells you which certificate it is: 0 is the server's own, higher numbers are intermediates.

Why it happens

• The server's certificate expired (depth 0)

  common

  Renewal failed or the renewed certificate was never loaded by the server or the load balancer.

• An intermediate in the served chain expired

  occasional

  Old chain files keep shipping an expired intermediate or cross-sign after the CA moved on; replace the chain with the CA's current one.

• The verifying machine's clock is ahead

  occasional

  A clock in the future makes valid certificates look expired; -attime helps separate clock issues from real expiry.

How to fix it

1. 1.

   Identify the expired certificate

   Read the depth and notAfter lines; -checkend tells you whether a certificate file expires within a given number of seconds, which is handy for monitoring.

   # The depth printed with the error identifies the certificate; s_client also prints notAfter
   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>&1 | grep -E '^depth|verify error|notAfter'
   # Check a file, and whether it expires within 30 days (exit 1 = yes)
   openssl x509 -in server.pem -noout -enddate -checkend 2592000

2. 2.

   Verify at a chosen time

   openssl verify -attime <unix time> shows whether the chain was valid at that moment, separating expiry from other errors.

   # Would the chain verify at another moment? (useful to separate clock problems)
   openssl verify -attime "$(date -d '2025-02-01' +%s)" -CAfile root.pem server.pem

3. 3.

   Renew and reload

   Renew the certificate, reload whatever terminates TLS, and confirm the new expiry from the network side.

   sudo certbot renew && sudo systemctl reload nginx
   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null | openssl x509 -noout -enddate

← Browse the full signature error database