X509_V_ERR_CERT_HAS_EXPIRED: certificate has expired

_Alien

I was trying to connect to my company openvpn network via MacOS openvpn application and hitting the warning "The server vpn.my_company.com has an UNTRUSTED SSL certificate. Allow the connection to proceed?"

When clicking the "More details", the reason states that "X509_V_ERR_CERT_HAS_EXPIRED: certificate has expired". But then I have the option to connect anyway

And I checked for more info from the OpenVPN admin webpage, the Certificate "Validation Results" section displays:

Web Certificate/Key validation results.
Certificate Trust Warning: certificate has expired
Valid From: 2018.08.24 00:00:00 UTC
Valid Until: 2020.08.23 23:59:59 UTC --> **which is few more months in future**

My certificate is issued by COMODO and its status is still active. Also, when I access the vpn.my_company.com via web browser, the certificate is still fine, i.e no warning about the expired certificate

Any idea why the OpenVPN application keeps warning me about expired cert? And is my connection via openvpn application actually unsecured? Or I can just ignore the warning?

Thanks a lot for any comment on this 🙂

TinCanTech

This does not sound like it has anything to do with openvpn but is a web certificate.

If you want to know howto proceed please see:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603

Pippin

I suspect:
https://forums.openvpn.net/viewtopic.php?f=22&t=30391

_Alien

Pippin wrote I suspect:
https://forums.openvpn.net/viewtopic.php?f=22&t=30391

nice!! Thanks very much!! I think that explained, as my access on 30 May was still OK, until today, 31st May the issue comes.

Also, "A more modern browser would have the USERTrust root already installed and trust it without needing to rely on the older AddTrust root." --> I think that is why accessing the website via Chrome gives no warning. I notice that the Certificate chain display from the browser is showing COMODO RSA Certification Authority

However, I'm still not sure how to clear the warning message though

Pippin

I would talk with "my_company.com"