state=error: certificate verify failed (certificate has expired)

Full message: "SSL_connect returned=1 errno=0 peeraddr=<ip>:<port> state=error: certificate verify failed (certificate has expired)". Certificates that are not valid yet produce "(certificate is not yet valid)".

Ruby openssl (Net::HTTP, Faraday, RubyGems) — OpenSSL::SSL::SSLError from SSL_connect

What it means

OpenSSL found a certificate in the chain whose validity period ended before the current time of the machine running Ruby. Most often the server's certificate was not renewed or the renewal was not deployed; on old systems an outdated CA bundle can make OpenSSL build the path through an expired root.

Why it happens

• The server's certificate expired

  common

  Renewal failed, or the service was not reloaded after renewal.

• An outdated CA bundle on an old system

  occasional

  Long-lived images and servers whose ca-certificates package was never updated may only know expired versions of public roots.

• The system clock is wrong

  occasional

  A clock in the future makes valid certificates look expired.

How to fix it

1. 1.

   Check the served certificate's end date

   If it is in the past, renew; if it is fine, look at the client's bundle and clock.

   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
     | openssl x509 -noout -subject -enddate

2. 2.

   Refresh the client's CA bundle

   Updating ca-certificates fixes clients that build paths through retired roots.

   # Old images: refresh the CA bundle Ruby's OpenSSL uses
   apt-get update && apt-get install --only-upgrade -y ca-certificates
   ruby -ropenssl -e 'p OpenSSL::X509::DEFAULT_CERT_FILE'

3. 3.

   Renew and reload the server

   Renew the certificate and reload the TLS terminator; check the result from the network side.

   sudo certbot renew && sudo systemctl reload nginx

← Browse the full signature error database