I've seen this before, where application or browsers fails to establish an SSL connection with a "Certificate expired" warning even though the SSL certificate in question is within its validity period - the test routine that actually fails is not a validity test of the end certificate but of the overall trust chain - this is sometimes referred to as a "peer verification" routine.
It might be because you trust an older version of one of the intermediate certificates - in this case it's not the SSL Certificate that is expired, but one of the certificates in the chain that your client builds to test the validity of the certificate:
(3) --- Verisign Root CA
(2) --> Verisign top Intermediate CA
(1) --> Verisign Issuing CA
(0) --> SSL Certificate
If you computer just has the Verisign Root CA certificate(3) in it's store of trusted CA certificates, it will rely on the chain of intermediate certs sent by the web server at www.bt.com:443
If the intermediates - cert (2) and/or (1) in the chain - have been reissued/replaced by newer certificates, but you have the previous version of these certificates stored in your intermediate trust store, the client might try to build the above chain using one of these, and will fail if they've expired
You can inspect the certificates that Chrome trust:
- Go to
chrome://settings/ (Or click the customize button in the upper right corner and select Settings)
- In the bottom, click "Show advanced settings"
- Under HTTPS/SSL, click "Manage Certificate"
- Inspect the contents of the different stores (names and number of trust stores will vary depending on the underlying operating system)
From here, you should be able to import new and remove old certificates as well.
To see the actual certs presented in the chain by the web server, use openssl:
openssl s_client -connect www.bt.com:443 -showcerts