当我的 CA 证书过期时，为什么 SSLLabs 说我的证书没问题？

Question

I did a scan of my domain using ssllabs.com, and this is what it says:

From what I can tell, one of my CAs is USERTrust RSA Certification Authority, and their certificate is expired, which SSLLabs flagged red, but it still says that there are no chain issues, and no browsers complain about talking to my domain.

I did the check after curl was complaining about an expired cert when talking to my domain, which may or may not be related.

What's going on here? How can an expired CA certificate not be a problem?

Answer 1

The expired certificate is actually not used for validation. It is unnecessarily send by your server, ie you could remove it from the certificate chain you send since modern system have a trusted CA builtin which effectively replaces this expired intermediate CA. For more details see for example USERTrust Intermediate Expiration in 2020 . To cite:

This is an old intermediate certificate and modern operating systems have a new version available and won't be affected. ... Based on what we know, equipment released or receiving security updates after June 2010 will most likely not be affected. ...