Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

If I visit BT's site in Chrome I get this ... http://imgur.com/b05alsX It looks like the cert has expired. (Similar in Firefox)

BT claim it isn't. https://twitter.com/BTCare/status/440405157999030272

And indeed this page http://www.digicert.com/help/ says expiry "September 24, 2014 (205 days from today)" for "www.bt.com"

One of my devices I saw this on yesterday is now not showing the error. But some of my devices still are. One of my friends has no problems. Basically some work and some don't.

What's going on?

Note I don't work for BT, I just use one of their services. As I do use SSL certs on my own servers I would love to know what is going on.

Is the old cert cached somewhere? Where would this cache be? BT's server level (maybe a load balancer or something), ISP, DNS, device?

Thanks in advance!

share|improve this question

closed as off-topic by Jenny D, MadHatter, Ward, mdpc, Scott Pack Mar 5 at 3:10

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Jenny D, MadHatter, Ward, mdpc, Scott Pack
If this question can be reworded to fit the rules in the help center, please edit the question.

2  
support.mozilla.org/en-US/questions/954856 says "This is a query that we come across every day. The client has an old certificate, renewed and installed the new certificate, but the old certificate is still showing. This usually means that the old certificate is still used somewhere within the network, such as a load balancing device or a frontend firewall. Online certificate checkers maybe checking on server/network, while the issue is actually somewhere else." –  James Mar 3 at 9:54

1 Answer 1

I've seen this before, where application or browsers fails to establish an SSL connection with a "Certificate expired" warning even though the SSL certificate in question is within its validity period - the test routine that actually fails is not a validity test of the end certificate but of the overall trust chain - this is sometimes referred to as a "peer verification" routine.

It might be because you trust an older version of one of the intermediate certificates - in this case it's not the SSL Certificate that is expired, but one of the certificates in the chain that your client builds to test the validity of the certificate:

(3) --- Verisign Root CA
    (2) --> Verisign top Intermediate CA
        (1) --> Verisign Issuing CA
            (0) --> SSL Certificate

If you computer just has the Verisign Root CA certificate(3) in it's store of trusted CA certificates, it will rely on the chain of intermediate certs sent by the web server at www.bt.com:443

If the intermediates - cert (2) and/or (1) in the chain - have been reissued/replaced by newer certificates, but you have the previous version of these certificates stored in your intermediate trust store, the client might try to build the above chain using one of these, and will fail if they've expired

You can inspect the certificates that Chrome trust:

  1. Go to chrome://settings/ (Or click the customize button in the upper right corner and select Settings)
  2. In the bottom, click "Show advanced settings"
  3. Under HTTPS/SSL, click "Manage Certificate"
  4. Inspect the contents of the different stores (names and number of trust stores will vary depending on the underlying operating system)

From here, you should be able to import new and remove old certificates as well.

To see the actual certs presented in the chain by the web server, use openssl:

openssl s_client -connect www.bt.com:443 -showcerts
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.