I'm trying to use OpenSSL to verify that an SSL certificate is still valid, but I keep getting strange results. The example site that I'm testing with (expired.badssl.com) has an expired SSL certificate.
Firefox flags this up as expired in April 2015 and shows the relevant warning, but when I look at the certificate information presented using OpenSSL s_client, it says it's still valid until 2016:
$ (echo "" | openssl s_client -connect expired.badssl.com:443 -CApath /etc/ssl/certs/ca-certificates.crt) | openssl x509 -noout -dates
[...]
depth=0 OU = Domain Control Validated, OU = PositiveSSL Wildcard, CN = *.badssl.com
verify return:1
DONE
notBefore=Apr 9 00:00:00 2015 GMT
notAfter=Jul 7 23:59:59 2016 GMT
I suspect I'm missing something here, but I can't figure out what it is.
4A:E7:95:49:FA:9A:BE:3F:10:0F:17:A4:78:E1:69:09
whereas the other has2f eb 18 25 18 7c 1a 50 86 40 7b 44 e5 b7 85 a5
. That doesn't solve the mystery though