certificate has expired
The server certificate has expired
Seen in curl, OpenSSL, Node.js (CERT_HAS_EXPIRED), Java (CertificateExpiredException)
A certificate in the chain is past its expiry date.
Common causes
- The site certificate expired.
- An intermediate or cross-signed root expired and the server still sends the old one.
- The client's trust store is too old to know the newer root.
How to fix it
- Renew and install the certificate; automate renewal.
- Make sure the server sends the current intermediate.
- Update the client's CA bundle or OS.
Got a different message? Paste it into the error explainer.
Related errors
- unable to get local issuer certificate · The client can't find the certificate's issuer
- unable to verify the first certificate · The intermediate certificate is missing
- self signed certificate in certificate chain · The chain ends in an untrusted root
- curl: (51) SSL: no alternative certificate subject name matches target host name · The certificate doesn't match the hostname
- curl: (35) SSL connect error · The TLS handshake failed
- sslv3 alert handshake failure · The server rejected the TLS handshake
- tlsv1 alert protocol version · The peer does not accept this TLS version
- tlsv1 alert unknown ca · The peer doesn't trust the certificate's CA
- no peer certificate available · The handshake failed before a certificate arrived
- Unable to establish SSL connection. · wget could not complete the TLS handshake
- ERROR: cannot verify example.com's certificate · wget doesn't trust the server's certificate
- Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames · The certificate doesn't cover this hostname