TLS — certificate has expired error
Diagnose expired TLS certificates by checking validity dates, clock skew and whether the presented certificate is the expected one.
Symptoms
- certificate has expired or is not yet valid
- The site worked yesterday and fails today
- curl fails with a certificate date error
- An internal service fails until the system clock is corrected
Possible causes
- The server certificate passed its notAfter date
- The client clock is wrong so a valid certificate looks expired
- A chain certificate, not the leaf, expired
- An automated renewal failed silently
Diagnosis steps
Read the validity dates
openssl s_client -connect host:443 -servername host 2>/dev/null | openssl x509 -noout -datesInterpretation
The notBefore and notAfter values show whether the certificate is expired or not yet valid.
Check the client clock
date -uInterpretation
A clock behind or ahead of real time makes valid certificates appear invalid, which is common in containers and VMs.
Verify the chain, not only the leaf
openssl s_client -connect host:443 -showcertsInterpretation
An expired intermediate can break validation even when the leaf is valid.
Root cause
A certificate in the chain was outside its validity window relative to the server time, because it expired, was not yet valid, or the client clock was skewed.
Fix
Renew and deploy the expired certificate, fix clock synchronization on clients and servers, and automate renewal with monitoring so expiry is caught before it causes an outage.
Verify the fix
Reconnect and confirm validation succeeds, and confirm the certificate dates now bracket the current time on both server and client.
Symptom walkthrough
TLS validation fails with certificate has expired or is not yet valid. The certificate may genuinely have passed its expiry, an intermediate in the chain may have expired, or the client clock may be wrong so a valid certificate appears invalid. The last case is common in containers and freshly booted virtual machines, where time synchronization has not yet caught up.
Fix in practice
Renew and deploy the expired certificate, fix clock synchronization on both ends, and verify the whole chain rather than only the leaf. Automate renewal with monitoring so expiry is detected long before it becomes an outage, since manual renewal is easy to forget.
Verification
Reconnect and confirm validation succeeds, then confirm the certificate validity window brackets the current time on both server and client. Valid dates plus a successful handshake confirm the fix.
Diagnostic commands
Check the behavior with commands like these:
openssl s_client -connect host:443 -servername host 2>/dev/null | openssl x509 -noout -dates
date -u
openssl s_client -connect host:443 -showcerts