ERROR: The certificate of 'api.example.com' has expired.

GnuTLS builds of wget print this line after the generic "ERROR: The certificate of '<host>' is not trusted." and before "The certificate has expired". OpenSSL builds print "ERROR: cannot verify <host>'s certificate, issued by '…':" followed by "Issued certificate has expired."

What it means

The server's certificate (or another certificate in its chain) is past its notAfter date according to this machine's clock, and wget's GnuTLS backend refuses the connection. The CA is trusted; only the validity period fails. wget exits with status 5.

Why it happens

• The certificate was not renewed

  common

  A renewal job that stopped running, an ACME challenge that fails after a DNS or firewall change, or a manually installed certificate that nobody tracked.

• A renewed certificate is on disk but not served

  common

  The TLS terminator (nginx, Apache, HAProxy, a load balancer or CDN) keeps serving the previously loaded certificate until it is reloaded or the new one is uploaded.

• The client's clock is wrong

  occasional

  A machine whose clock is far in the future sees valid certificates as expired. Embedded boards without a real-time clock often boot with a wrong date until NTP has synchronised.

How to fix it

1. 1.

   Check the dates of the certificate actually served

   Compare notAfter with the current UTC time. If the served certificate is old but a newer one exists, the server has not picked it up.

   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
     | openssl x509 -noout -subject -startdate -enddate

2. 2.

   Renew and reload

   Renew through your ACME client or CA, then reload every service that terminates TLS for the name; automate both steps so the next renewal does not depend on someone remembering.

   sudo certbot renew --cert-name api.example.com
   sudo systemctl reload nginx     # or apache2 / haproxy: reload whatever terminates TLS

3. 3.

   Fix the client's time

   If the certificate is valid when checked from another machine, enable NTP on the failing one.

   date -u
   timedatectl status
   sudo timedatectl set-ntp true

← Browse the full signature error database