2

I am using Let's Encrypt via Certbot on RHEL to get SSL for my server. Recently I had to renew my certificate, which I did. Everything went fine with certbot renewal dry-run, and I updated my certificate. Now if I open the site, it shows the new certificate expires in three months, but when I use this command to check the certificate expiry:

echo | openssl s_client -connect mysite.com:443 2>/dev/null | openssl x509 -noout -dates

it shows the certificate is already expired (the old one). I'm not sure what am I missing? Why browser can find the correct certificate while openssl cannot?

Thanks

Improve this question
4
  • SSLLabs shows same thing as the browser. It says the certificate is correct, with correct expiry time, but OpenSSL still uses the old certificate. Android and iOS also fail to talk to the server complaining about expired certificate!!
    – m.hashemian
    Commented Aug 26, 2016 at 16:34
  • additional information should be added to the question and not placed in a comment. Also, without knowing which site you are talking about one can only do an educated guess what the problem might be but not verify this guess.
    – Steffen Ullrich
    Commented Aug 26, 2016 at 16:41
  • This was not an additional information, it was a response to another comment asking me to test the site on SSLLabs, but the person deleted his comment for some reason.
    – m.hashemian
    Commented Aug 26, 2016 at 16:42
  • ok, but at the end these are still important additional information which might help to answer your question. So it would be good to add these to the question - and maybe also the hostname of the site.
    – Steffen Ullrich
    Commented Aug 26, 2016 at 16:48

1 Answer 1

Reset to default
4

Browser probably uses SNI, while openssl as you wrote it doesn't. Try this:

echo | openssl s_client -connect mysite.com:443 -servername mysite.com 2>/dev/null | openssl x509 -noout -dates

Improve this answer
3
  • you are right, that is the problem. When I use -servername mysite.com openssl also shows the correct expiry date as browser. do you know what I need to change in the server settings? (already started reading a bit more about SNI)
    – m.hashemian
    Commented Aug 26, 2016 at 16:44
  • 1
    Check apache's config. There it should appear at least two SSLCertificateFile that probably point to two different files. Just change the first one (default) to the second (which should have your server hostname)
    – NuTTyX
    Commented Aug 26, 2016 at 16:52
  • That's correct, thanks a lot. There were 3 tags in httpd.conf SSLCertificateFile, SSLCertificateKeyFile, and SSLCertificateChainFile, which were pointing to certificates from letsencrypt, but there were the same tags in ssl.conf pointing to /etc/pki/tls. I modified the values in ssl.conf to point to letsencrypt files as well, and restarted the server and it worked. Thanks a lot.
    – m.hashemian
    Commented Aug 26, 2016 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .