Certificates and accurate time

A secure connection depends on more than a certificate file. Both endpoints need a sufficiently accurate view of time to decide whether a certificate is valid.

Read the whole error

An expired certificate and an untrusted issuer are different problems. A hostname mismatch is another independent check. Replacing a certificate does not correct an inaccurate system clock, and disabling verification hides useful evidence.

Keep renewal automatic

Automated renewal should include a check that the running service presents the renewed certificate. A successful renewal command only confirms one part of the process. Test the public endpoint after reloading the service.

Check the client as well

A device restored from an old backup or disconnected for a long time may have the wrong date. Verify time synchronization before changing network settings. Keep the configured hostname consistent with the name covered by the certificate.

Make maintenance observable

Record the time of a change and verify a small, known request before and after it. A useful check distinguishes connection failure, certificate verification failure, and an unexpected application response.