[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired

Identical wording in Python with OpenSSL 1.1.1, 3.0 and 3.5, followed by a source location such as "(_ssl.c:1082)". A certificate whose validity has not started yet gives "certificate is not yet valid".

Python ssl module (OpenSSL) — ssl.SSLCertVerificationError, X509_V_ERR_CERT_HAS_EXPIRED (10)

What it means

OpenSSL found a certificate in the chain whose validity ended before the current time of this machine. Usually the server's certificate was not renewed or the renewed one is not being served; sometimes the client builds the path through an expired root from an outdated CA bundle, or its clock is wrong.

Why it happens

• The server's certificate (or intermediate) expired

  common

  Renewal did not run, or ran but the service was not reloaded. Check the dates of the certificate actually served before changing anything on the client.

• An outdated certifi or system bundle

  occasional

  Environments pinned to an old certifi release (or old OS images) may only know expired versions of roots and build an expired path, while current clients succeed. This is what broke many Python clients when the DST Root CA X3 cross-sign expired in 2021.

• The client's clock is wrong

  occasional

  A VM or container host with a clock in the future makes valid certificates appear expired. If every site fails at once, check the time first.

How to fix it

1. 1.

   Look at the served certificate

   Fetch the certificate once with verification disabled, only to read it, and check notAfter (paste it into the decoder). Do not use that unverified connection for anything else.

   import socket, ssl
   
   # Read the served certificate without verifying it, to see its dates
   ctx = ssl.create_default_context()
   ctx.check_hostname = False
   ctx.verify_mode = ssl.CERT_NONE
   with socket.create_connection(("api.example.com", 443)) as raw:
       with ctx.wrap_socket(raw, server_hostname="api.example.com") as tls:
           der = tls.getpeercert(binary_form=True)
   print(ssl.DER_cert_to_PEM_cert(der))   # paste into a certificate decoder

2. 2.

   Update certifi or the OS bundle

   If the server's own certificate is fine, refresh the client's roots: pip install --upgrade certifi for libraries that use certifi, the ca-certificates package for the system bundle.

   python3 -m pip install --upgrade certifi
   python3 -c "import certifi; print(certifi.__version__, certifi.where())"

3. 3.

   Correct the system clock

   Enable NTP on the client (on the host, for containers).

   date -u
   sudo timedatectl set-ntp true

← Browse the full signature error database