1

I am using Let's Encrypt via Certbot on RHEL to get SSL for my server. Recently I had to renew my certificate, which I did. Everything went fine with certbot renewal dry-run, and I updated my certificate. Now if I open the site, it shows the new certificate expires in three months, but when I use this command to check the certificate expiry:

echo | openssl s_client -connect mysite.com:443 2>/dev/null | openssl x509 -noout -dates

it shows the certificate is already expired (the old one). I'm not sure what am I missing? Why browser can find the correct certificate while openssl cannot?

Thanks

  • SSLLabs shows same thing as the browser. It says the certificate is correct, with correct expiry time, but OpenSSL still uses the old certificate. Android and iOS also fail to talk to the server complaining about expired certificate!! – m.hashemian Aug 26 '16 at 16:34
  • additional information should be added to the question and not placed in a comment. Also, without knowing which site you are talking about one can only do an educated guess what the problem might be but not verify this guess. – Steffen Ullrich Aug 26 '16 at 16:41
  • This was not an additional information, it was a response to another comment asking me to test the site on SSLLabs, but the person deleted his comment for some reason. – m.hashemian Aug 26 '16 at 16:42
  • ok, but at the end these are still important additional information which might help to answer your question. So it would be good to add these to the question - and maybe also the hostname of the site. – Steffen Ullrich Aug 26 '16 at 16:48
4

Browser probably uses SNI, while openssl as you wrote it doesn't. Try this:

echo | openssl s_client -connect mysite.com:443 -servername mysite.com 2>/dev/null | openssl x509 -noout -dates

  • you are right, that is the problem. When I use -servername mysite.com openssl also shows the correct expiry date as browser. do you know what I need to change in the server settings? (already started reading a bit more about SNI) – m.hashemian Aug 26 '16 at 16:44
  • 1
    Check apache's config. There it should appear at least two SSLCertificateFile that probably point to two different files. Just change the first one (default) to the second (which should have your server hostname) – NuTTyX Aug 26 '16 at 16:52
  • That's correct, thanks a lot. There were 3 tags in httpd.conf SSLCertificateFile, SSLCertificateKeyFile, and SSLCertificateChainFile, which were pointing to certificates from letsencrypt, but there were the same tags in ssl.conf pointing to /etc/pki/tls. I modified the values in ssl.conf to point to letsencrypt files as well, and restarted the server and it worked. Thanks a lot. – m.hashemian Aug 26 '16 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.