1

The SSL certificate (of Let's Encrypt) of one of our websites (https://edu.electrosuisse.ch) expired yesterday morning. It has renewed itself using the services of Let's Encrypt several days ago. Yet the browsers that already got the old certificate seem still to be using the expired one without showing any warnings. [Shift] + Reload does not fix this.

If you open a browser window in 'private mode' then the new one is being used. But this does not update the cert of the regular browser window, neither.

(Also online SSL check tools show the new SSL certificate.)

Same behaviour for Firefox as with Chrome/Edge Chromium.

So there seems not to be any problem, but does anybody know why browsers do behave like this?

(Unfortunately search engines just deliver results for problems with expired certs etc.)

Info displayed in regular browser window

Validity

Not Before: Fri, 27 Nov 2020 04:43:23 GMT

Not After: Thu, 25 Feb 2021 04:43:23 GMT

Info displayed in private browser window

Validity

Not Before: Tue, 26 Jan 2021 07:47:26 GMT

Not After: Mon, 26 Apr 2021 07:47:26 GMT

Improve this question
3
  • A January valid date is displayed regardless if I use a private session or not, so the reason you are getting different certificates has nothing to do with that. Regardless the certificate is valid. The certificate indicates it expires in 3 months. – Ramhound Feb 26 at 8:21
  • Yes, @Ramhound I guess, today you - most presumably - opened this site for the first time. So your browser has fetched a fresh copy of the new certificate directly from the server. This 'effect' just seems to take place if you have visited the site before and an old copy of the cert. is already stored in your browser... Thnx anyway! – ikellenberger Feb 26 at 10:06
  • Getting the old certificate is a client problem not a server problem – Ramhound Feb 26 at 17:21
1

Chrome stores (caches) SSL certificates in the browser history. Instead of re-fetching them every time, Chrome reads them off the cache. In private mode the history is not used and nothing is saved to it, hence the new certificate is fetched.

Source: this answer on ServerFault.

EDIT: The caching is done to speed up the browsing experience, but my common sense, too, tells me that an expired certificate should trigger a re-fetch regardless. This seems like a bug in Chromium that was reported in 2012 (and closed as a duplicate of this issue). Internet Explorer has similar behavior. The comments in the former bug report should provide more insights as to why they decided to do this.

Improve this answer
1
  • 1
    Hey @ikellenberger, I updated my answer to hopefully help regarding question A, but as to question B I'm clueless too :) – Bip901 Feb 26 at 18:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.