0

is it possible that the TLS handshake will fail if the server presents a certificate that is expired ? I can see CLient Hello, and next Server Hello + Certificate from Server and next the receiver is sending a FIN packet to close abrupt the connection. May it be because the certificate expired few months back ?

thanks

Improve this question
2
  • Which part is the "receiver". The client or the server?
    – Steffen Ullrich
    Commented Nov 25, 2016 at 15:10
  • it is the client Steffen.
    – cyzczy
    Commented Nov 25, 2016 at 15:11

2 Answers 2

Reset to default
4

Absolutely. An expired certificate is not a valid one. A certificate should only be accepted if :

  • it is signed by a valid authority - ie, there is a valid certificate chain back to a trusted root certificate authority
  • it is for the subject that is being connected to - ie, hostname of the machine being connected to matches the subject name in the certificate (or subject alternative name)
  • it is within date
  • it has not been revoked (either by being included on the client's revocation list or through an online certificate status check from the certificate authority)

Get a valid cert.

Improve this answer
4

If the validation of the certificate fails the client sends either a TLS alert (well behaved) or just closes the connection (bad behaved but common). Since the validation failed because the certificate is expired this is probably what you see.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .