I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL certificate.
Firefox flags this up as expired in April 2015 and shows the relevant warning, but when I look at the certificate information presented using OpenSSL s_client, it says it's still valid until 2016:
$ (echo "" | openssl s_client -connect expired.badssl.com:443 -CApath /etc/ssl/certs/ca-certificates.crt) | openssl x509 -noout -dates [...] depth=0 OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.badssl.com verify return:1 DONE notBefore=Apr 9 00:00:00 2015 GMT notAfter=Jul 7 23:59:59 2016 GMT
I suspect I'm missing something here, but I can't figure out what it is.