How the tools word it
| OpenSSL 3.6 s_client | verify error:num=10:certificate has expired |
|---|---|
| OpenSSL 3.6 verify | error 10 at 0 depth lookup: certificate has expired |
| curl 8.23 | curl: (60) SSL certificate OpenSSL verify result: certificate has expired (10) |
| Node 26 tls | CERT_HAS_EXPIRED: certificate has expired |
| Python 3.14 ssl | ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1082) |
Common causes
The Not after date has passed
The certificate below ended on 1 June 2025. The Decoder compares the date with your device's clock and says Expired. Any client with a correct clock refuses it.
Input
-----BEGIN CERTIFICATE----- MIIB7zCCAZWgAwIBAgIBBTAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw HhcNMjUwMTAxMDAwMDAwWhcNMjUwNjAxMDAwMDAwWjAwMRgwFgYDVQQKDA9mam9y ZHRvb2xzIHRlc3QxFDASBgNVBAMMC3NlcnZlci50ZXN0MFkwEwYHKoZIzj0CAQYI KoZIzj0DAQcDQgAE7ee19O78yqmyOB5x/h4K7/QA6YW32XJesJT8lv2Q+Y0GBR4e r2DpKzlXcNQ5G7VN9GkztuzSnXch/wKr38FQdqOBjjCBizAMBgNVHRMBAf8EAjAA MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAWBgNVHREEDzAN ggtzZXJ2ZXIudGVzdDAdBgNVHQ4EFgQU/HjqRgLgUEQQDnr1y8nhCcb2baowHwYD VR0jBBgwFoAUMt7RDnv6EJHcKso7bd3VWZC9krowCgYIKoZIzj0EAwIDSAAwRQIh AIbt1+BnlqhHATXiOl3AkVhFLI92pPqpvXFvcDriHR4EAiBLFCmVtKGgULE5YNBB a6kz+QqomVtIqsB3UabZbRbd3w== -----END CERTIFICATE-----
Certificate Decoder says
Expired · Not after 2025-06-01 00:00:00 UTC
Another certificate in the chain has expired
The error does not say which certificate. OpenSSL names the depth: at 0 is the server's own certificate, a higher number is an issuer. Paste the whole chain and the status line counts the expired ones; each row shows its time left.
Input
-----BEGIN CERTIFICATE----- MIIB7zCCAZWgAwIBAgIBBTAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw HhcNMjUwMTAxMDAwMDAwWhcNMjUwNjAxMDAwMDAwWjAwMRgwFgYDVQQKDA9mam9y ZHRvb2xzIHRlc3QxFDASBgNVBAMMC3NlcnZlci50ZXN0MFkwEwYHKoZIzj0CAQYI KoZIzj0DAQcDQgAE7ee19O78yqmyOB5x/h4K7/QA6YW32XJesJT8lv2Q+Y0GBR4e r2DpKzlXcNQ5G7VN9GkztuzSnXch/wKr38FQdqOBjjCBizAMBgNVHRMBAf8EAjAA MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAWBgNVHREEDzAN ggtzZXJ2ZXIudGVzdDAdBgNVHQ4EFgQU/HjqRgLgUEQQDnr1y8nhCcb2baowHwYD VR0jBBgwFoAUMt7RDnv6EJHcKso7bd3VWZC9krowCgYIKoZIzj0EAwIDSAAwRQIh AIbt1+BnlqhHATXiOl3AkVhFLI92pPqpvXFvcDriHR4EAiBLFCmVtKGgULE5YNBB a6kz+QqomVtIqsB3UabZbRbd3w== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIBzzCCAXWgAwIBAgIBAzAKBggqhkjOPQQDAjA5MRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxHTAbBgNVBAMMFGZqb3JkdG9vbHMgdGVzdCByb290MB4XDTI2MDEw MTAwMDAwMFoXDTM2MDEwMTAwMDAwMFowQTEYMBYGA1UECgwPZmpvcmR0b29scyB0 ZXN0MSUwIwYDVQQDDBxmam9yZHRvb2xzIHRlc3QgaW50ZXJtZWRpYXRlMFkwEwYH KoZIzj0CAQYIKoZIzj0DAQcDQgAE8S+llYHyI61wNUPj0DPhpIyF+hRxM7dJFQdo lkEFplO8LVCXy7RgHxRttTDP+Od2kJV2tmdXrQXeLPMGOrG0C6NmMGQwEgYDVR0T AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFDLe0Q57+hCR 3CrKO23d1VmQvZK6MB8GA1UdIwQYMBaAFLcg9Ms28bssX2hEC2iuZ/lj9P4oMAoG CCqGSM49BAMCA0gAMEUCIQDEsN76EmigQQoI21DUJpyRdSt2nQdhomZ1IAkxNuLe 4wIgL4BbGPQ84ODnLT1cTE2A2olMZgsjQDfiaRDDuW41iS8= -----END CERTIFICATE-----
Certificate Decoder says
2 certificates, 1 expired
The certificate is fine and the clock is wrong
A virtual machine, a CI runner, a container host or a device whose clock was reset can believe it is another year. If the Decoder says Valid and the client says expired, check the client's date.
Input
-----BEGIN CERTIFICATE----- MIIB7jCCAZWgAwIBAgIBBDAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw HhcNMjYwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjAwMRgwFgYDVQQKDA9mam9y ZHRvb2xzIHRlc3QxFDASBgNVBAMMC3NlcnZlci50ZXN0MFkwEwYHKoZIzj0CAQYI KoZIzj0DAQcDQgAE7ee19O78yqmyOB5x/h4K7/QA6YW32XJesJT8lv2Q+Y0GBR4e r2DpKzlXcNQ5G7VN9GkztuzSnXch/wKr38FQdqOBjjCBizAMBgNVHRMBAf8EAjAA MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAWBgNVHREEDzAN ggtzZXJ2ZXIudGVzdDAdBgNVHQ4EFgQU/HjqRgLgUEQQDnr1y8nhCcb2baowHwYD VR0jBBgwFoAUMt7RDnv6EJHcKso7bd3VWZC9krowCgYIKoZIzj0EAwIDRwAwRAIg VatubrykL+ZDu2wIXIFzNCA4G6SIsUQnf2mw4c30KXMCICf1jBo0UciVihHiS1KE k6cc1SY9pCBuOPjwOoiC3ob3 -----END CERTIFICATE-----
Certificate Decoder says
Valid · Not after 2036-01-01 00:00:00 UTC
The certificate is not valid yet
The opposite message. A certificate has a Not before date as well, and OpenSSL words the failure as certificate is not yet valid or the system clock is incorrect (error 9). A clock that runs behind causes it too.
Input
-----BEGIN CERTIFICATE----- MIIB9DCCAZmgAwIBAgIBCDAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw IhgPMjA5OTAxMDEwMDAwMDBaGA8yMTAwMDEwMTAwMDAwMFowMDEYMBYGA1UECgwP ZmpvcmR0b29scyB0ZXN0MRQwEgYDVQQDDAtzZXJ2ZXIudGVzdDBZMBMGByqGSM49 AgEGCCqGSM49AwEHA0IABO3ntfTu/Mqpsjgecf4eCu/0AOmFt9lyXrCU/Jb9kPmN BgUeHq9g6Ss5V3DUORu1TfRpM7bs0p13If8Cq9/BUHajgY4wgYswDAYDVR0TAQH/ BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwFgYDVR0R BA8wDYILc2VydmVyLnRlc3QwHQYDVR0OBBYEFPx46kYC4FBEEA569cvJ4QnG9m2q MB8GA1UdIwQYMBaAFDLe0Q57+hCR3CrKO23d1VmQvZK6MAoGCCqGSM49BAMCA0kA MEYCIQCFZOkf/WQ40BmmfLKmgc0/0tUtesrmPAxYDyQ7mNhGRQIhAPVc9uPr1n2Y dezI/w3eCYayQRfdwBbg6EU+1ersfkj+ -----END CERTIFICATE-----
Certificate Decoder says
Not valid yet · Not before 2099-01-01 00:00:00 UTC
How to fix it
- Renew the certificate with your CA or ACME client and install the new file. Most servers keep the old certificate in memory until they are reloaded.
- Check what the server really sends: openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -enddate prints the Not after date.
- Paste the certificate, or the whole chain, into the Certificate Decoder to see which one expired and how long ago.
- If the certificate is valid but the client says it has expired, correct the client's clock and enable time synchronisation (NTP).
- If you renewed and the old date still shows, a second server, a load balancer or a CDN is probably still serving the old certificate. Run the command above against each.