When I try to connect to my OCServ using OpenConnect client in ubuntu it throws an error:

Connected to x.x.x.x:yyy
SSL negotiation with server.domain.tld
Server certificate verify failed: certificate expired

Certificate from VPN server "server.domain.tld" failed verification.
Reason: certificate expired
To trust this server in future, perhaps add this to your command line:
    --servercert pin-sha256:02oy27uQkY5fMYDda0sSLIj1SbioAHRRbqUneUeI6OA=
Enter 'yes' to accept, 'no' to abort; anything else to view:

When I press a key to view the cert, the expiration date is ok and it is not expired!

X.509 Certificate Information:
Version: 3
Serial Number (hex): xyzxyzxyz..
Issuer: CN=R3,O=Let's Encrypt,C=US
    Not Before: Wed Sep 08 21:10:50 UTC 2021
    Not After: Tue Dec 07 21:10:49 UTC 2021
Subject: CN=server.domain.tld
Subject Public Key Algorithm: EC/ECDSA
Algorithm Security Level: Ultra (384 bits)
    Curve:  SECP384R1

My system date is correct, Sunday, Oct 3, 2021. This was working correctly for the past year, but after the recent letencrypt cert auto renewal, I noticed that it is not working correctly.


1 Answer 1


Try updating the "ca-certificates" package. I had the same problem, and I solved it this way.

  • yeah, this solved the problem! I did also update the /etc/vpnc/vpnc-script
    – Alimo
    Commented Oct 6, 2021 at 22:15
  • I have exact same issue with a LetsEncrypt certificate created an hour ago. And apparently I have the latest version of ca-certificates already (20211016ubuntu0.22.04.1). Any suggestions? Commented Jan 3, 2023 at 13:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .