I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL certificate.

Firefox flags this up as expired in April 2015 and shows the relevant warning, but when I look at the certificate information presented using OpenSSL s_client, it says it's still valid until 2016:

$ (echo "" | openssl s_client -connect expired.badssl.com:443 -CApath /etc/ssl/certs/ca-certificates.crt) | openssl x509 -noout -dates
depth=0 OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.badssl.com
verify return:1
notBefore=Apr  9 00:00:00 2015 GMT
notAfter=Jul  7 23:59:59 2016 GMT

I suspect I'm missing something here, but I can't figure out what it is.

  • 1
    The certificate as seen by Firefox has fingerprint 4A:E7:95:49:FA:9A:BE:3F:10:0F:17:A4:78:E1:69:09 whereas the other has ‎2f eb 18 25 18 7c 1a 50 86 40 7b 44 e5 b7 85 a5. That doesn't solve the mystery though – Hagen von Eitzen Jul 31 '15 at 12:42

I think you are missing -servername expired.badssl.com

$ echo "" | openssl s_client -connect expired.badssl.com:443 -CApath /etc/ssl/certs/ca-certificates.crt -servername expired.badssl.com 2>/dev/null | openssl x509 -noout -subject -dates

subject= /OU=Domain Control Validated/OU=PositiveSSL Wildcard/CN=*.badssl.com  
notBefore=Apr  9 00:00:00 2015 GMT  
notAfter=Apr 12 23:59:59 2015 GMT

Apparently this server hosts several HTTPS services...

$ host badssl.com
badssl.com has address

$ host expired.badssl.com
expired.badssl.com has address

... so the Server Name Indication extension is mandatory to get the appropriate certificate instead of the one corresponding to the default site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.