0

is it possible that the TLS handshake will fail if the server presents a certificate that is expired ? I can see CLient Hello, and next Server Hello + Certificate from Server and next the receiver is sending a FIN packet to close abrupt the connection. May it be because the certificate expired few months back ?

thanks

  • Which part is the "receiver". The client or the server? – Steffen Ullrich Nov 25 '16 at 15:10
  • it is the client Steffen. – cyzczy Nov 25 '16 at 15:11
4

Absolutely. An expired certificate is not a valid one. A certificate should only be accepted if :

  • it is signed by a valid authority - ie, there is a valid certificate chain back to a trusted root certificate authority
  • it is for the subject that is being connected to - ie, hostname of the machine being connected to matches the subject name in the certificate (or subject alternative name)
  • it is within date
  • it has not been revoked (either by being included on the client's revocation list or through an online certificate status check from the certificate authority)

Get a valid cert.

4

If the validation of the certificate fails the client sends either a TLS alert (well behaved) or just closes the connection (bad behaved but common). Since the validation failed because the certificate is expired this is probably what you see.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.