Table of Contents
What “certificate has expired” means
TLS presents a chain of X.509 certificates: leaf → intermediate(s) → root. The client checks that every cert’s validity window (notBefore … notAfter) contains the current time. If any one is past notAfter, the handshake fails with an expiry error.
Parse it with openssl
openssl x509 -in cert.pem -noout -dates
# notBefore=May 1 00:00:00 2025 GMT
# notAfter =Apr 30 23:59:59 2026 GMT
openssl x509 -in cert.pem -noout -subject -issuerIf notAfter is in the past, that cert is the problem.
Common causes
- Renewal forgotten. The leaf cert lapsed; renew and redeploy.
- Wrong cert served. The server is still pointing at the old file after renewal.
- Expired intermediate. Your bundle includes an intermediate that lapsed; update the full chain.
- Clock skew. Client or server time is off, making a valid cert look expired (or vice versa).
Check the chain, not just the leaf
Browsers and libraries validate the entire chain, so an expired intermediate hidden in the bundle breaks everything even when the leaf is fine.
openssl s_client -connect example.com:443 -showcertsInspect each printed BEGIN CERTIFICATE block for its notAfter.
Parse without the terminal
Paste a certificate and read its validity window, subject, and issuer with the Certificate Parser on Toolbox.
Related tools
Next steps
- Tokens fail the same “proof broken” way — JWT signature verification failed.
- Expiry math uses Unix time — Unix Timestamp: 10 vs 13 digits.
Frequently asked questions
Which certificate expired — the leaf or a CA?
Either. A client validates the whole chain, so an expired intermediate or root in the served chain fails just like an expired leaf. Parse each cert in the chain to find the bad one.
Can I read a cert without openssl?
Yes. Any X.509 parser shows the subject, issuer, notBefore, and notAfter. The key fields are the validity window (notBefore–notAfter).
Why did it expire with days left on the calendar?
Client and server clocks can differ, or the cert's notAfter is in UTC while you read local time. Compare in UTC and allow a small clock-skew leeway.
Guide Info
- Category
- How-to
- Difficulty
- Intermediate
- Reading Time
- 2 min
- Tags
- #x509 #certificate #tls #ssl
Next guide
JWT signature verification failed: A Debugging Checklist
When a library throws 'signature verification failed', the token decoded fine — the math just did not check out. Walk this checklist to find the exact mismatch.