Score:-2

Server

Cannot renew ssl certificates, notAfter never changes

SS YY KK

1/19/23, 10:57 AM

Last two days I have been trying to fix ssl certificate problem in our servers.

We have two servers A and B, I was able to connect A to B but B changed ssl certificate. They shared this key and we imported that one but when I try to connect B I am getting

$  openssl s_client -CApath /etc/ssl/certs/ -connect B:443
verify error:num=10:certificate has expired
notAfter=Sep 17 12:00:00 2021 GMT

So this is still old. Then I try to understand if I couldn't import new .crt file, and if it is sill old one.

$ openssl x509 -in B.crt -noout -dates
   notBefore=Aug  4 00:00:00 2021 GMT
   notAfter=Aug  4 23:59:59 2022 GMT

No, as you see certificate is new and valid. So I tried to use it to test connection to B.

$ openssl s_client  -connect B:443 -CAfile B.crt

But it still returns

 verify error:num=10:certificate has expired
 notAfter=Sep 17 12:00:00 2021 GMT

What should I do now?

0 + 0

ssl

Gerald Schneider

1/19/23, 11:16 AM

Did you restart the service after replacing the certificate files?

SS YY KK

1/19/23, 11:36 AM

Do you mean openssl ? I didn't restart anything, even I use -CAfile, there is two different result. When I check validity from .crt file, then it seems valid. But when I try to connect this valid crt file, it returns as it never use .crt file.

Gerald Schneider

1/19/23, 12:18 PM

After replacing a certificate file you need to restart or reload the services that use it, so they can load the new certificate.

Score:1

Server

vidarlo

1/19/23, 11:18 AM

$  openssl s_client -CApath /etc/ssl/certs/ -connect B:443
verify error:num=10:certificate has expired
notAfter=Sep 17 12:00:00 2021 GMT

So B sends an expired certificate. According to comments, they send a valid certificate when you use SNI to request the certificate for name B.

The solution is obviously to use SNI, as this is what B has tested and implemented.

0 + 0

SS YY KK

1/19/23, 11:29 AM

But when I try the certificate that they send, such as openssl x509 -in B.crt -noout -dates I get right dates.

vidarlo

1/19/23, 11:31 AM

B is obviously not using that certificate as the dates doesn't match. When you connect to B, B sends a certificate that it uses to authenticate itself. What matters is the certificate B sends, not what you have stored locally.

SS YY KK

1/19/23, 11:31 AM

I can see from browser that they are using this certificate, dates matches with browser.

vidarlo

1/19/23, 12:29 PM

So you're not running B? Contact whoever is running B.

SS YY KK

1/19/23, 12:56 PM

Thanks, since they are able to connect with SNI such as openssl s_client -CApath /etc/ssl/certs/ -connect B:443 -servername B , they say problem is with our certificates. But when I check https://serverfault.com/questions/799345/openssl-returns-the-expired-certificate-while-browser-shows-the-correct-one post I think they need to alter some config files, what do you think?

vidarlo

1/19/23, 1:26 PM

Ok, so they obviously expect SNI. Have you *tried* with SNI? I can't quite get heads or tails of this question.

SS YY KK

1/19/23, 1:59 PM

Hmm, yes I tried. I could get Verify return code: 0 (ok) with SNI $openssl s_client -connect B:443 -servername B. Thanks, I will inform B and let them know the problem is in their side.

vidarlo

1/19/23, 2:01 PM

The problem is not on their side. They obviously expect you to use SNI, and you don't.

SS YY KK

1/19/23, 2:18 PM

They removed sni control while binding certificate. Now it is working, thanks.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Cannot renew ssl certificates, notAfter never changes

TH: ไม่สามารถต่ออายุใบรับรอง ssl ไม่ได้หลังจากไม่เคยเปลี่ยนแปลง

RO: Nu se pot reînnoi certificatele ssl, notAfter nu se modifică niciodată

RU: Невозможно обновить ssl-сертификаты, notAfter никогда не меняется

VI: Không thể gia hạn chứng chỉ ssl, notafter không bao giờ thay đổi

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.