# gnutls-cli --x509cafile=ca.pem expired-root-ca-test.germancoding.com
Processed 2 CA certificate(s).
Resolving 'expired-root-ca-test.germancoding.com'...
Connecting to '2a01:4f8:151:506c::2:443'...
...
- Status: The certificate is NOT trusted. The certificate chain uses expired certificate.
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.
*** Handshake has failed
GnuTLS error: Error in the certificate.
# faketime 2021-10-01 gnutls-cli canonical.com
Processed 129 CA certificate(s).
Resolving 'canonical.com'...
Connecting to '2001:67c:1360:8001::2c:443'...
...
- Status: The certificate is NOT trusted. The certificate chain uses expired certificate.
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.
*** Handshake has failed
GnuTLS error: Error in the certificate.
Reproduced original problem, upgraded libgnutls30 and gnutls-bin
# gnutls-cli --x509cafile=ca.pem expired- root-ca- test.germancodi ng.com root-ca- test.germancodi ng.com' ... 151:506c: :2:443' ...
Processed 2 CA certificate(s).
Resolving 'expired-
Connecting to '2a01:4f8:
...
- Status: The certificate is NOT trusted. The certificate chain uses expired certificate.
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.
*** Handshake has failed
GnuTLS error: Error in the certificate.
# faketime 2021-10-01 gnutls-cli canonical.com 1360:8001: :2c:443' ...
Processed 129 CA certificate(s).
Resolving 'canonical.com'...
Connecting to '2001:67c:
...
- Status: The certificate is NOT trusted. The certificate chain uses expired certificate.
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.
*** Handshake has failed
GnuTLS error: Error in the certificate.
Reproduced original problem, upgraded libgnutls30 and gnutls-bin
# dpkg-query -W libgnutls30 gnutls-bin
gnutls-bin 3.4.10-4ubuntu1.9
libgnutls30:amd64 3.4.10-4ubuntu1.9
Things are good now:
# gnutls-cli --x509cafile=ca.pem expired- root-ca- test.germancodi ng.com root-ca- test.germancodi ng.com' ... 151:506c: :2:443' ... -(ECDHE- RSA-SECP256R1) -(AES-256- GCM) 86:1B:69: 79:FC:37: AD:AD:A5: 82:11:46: 84:4F:B4: 46:DC:C1: E7:2E:A9: 40:18:6C: 8A:B9:4C: B9:7E
Processed 2 CA certificate(s).
Resolving 'expired-
Connecting to '2a01:4f8:
...
- Status: The certificate is trusted.
- Description: (TLS1.2)
- Session ID: 53:9C:C7:
- Ephemeral EC Diffie-Hellman parameters
- Using curve: SECP256R1
- Curve size: 256 bits
- Version: TLS1.2
- Key Exchange: ECDHE-RSA
- Server Signature: RSA-SHA256
- Cipher: AES-256-GCM
- MAC: AEAD
- Compression: NULL
- Options: extended master secret, safe renegotiation, OCSP status request,
- Handshake was completed
# faketime 2021-10-01 gnutls-cli canonical.com 1360:8001: :2b:443' ... -(ECDHE- RSA-SECP256R1) -(AES-256- GCM) 22:86:03: D2:13:17: 6E:F1:20: 8A:57:B8: E9:FF:0E: 07:AB:1E: 61:F6:7F: 56:43:EF: BF:7A:F3: EF:56
Processed 129 CA certificate(s).
Resolving 'canonical.com'...
Connecting to '2001:67c:
- Certificate type: X.509
- Got a certificate list of 3 certificates.
...
- Status: The certificate is trusted.
- Description: (TLS1.2)
- Session ID: 71:90:E2:
- Ephemeral EC Diffie-Hellman parameters
- Using curve: SECP256R1
- Curve size: 256 bits
- Version: TLS1.2
- Key Exchange: ECDHE-RSA
- Server Signature: RSA-SHA256
- Cipher: AES-256-GCM
- MAC: AEAD
- Compression: NULL
- Options: extended master secret, safe renegotiation,
- Handshake was completed
All is good. Test website connectivity works, and future connectivity to canonical.com also works.
xenial is verified.