title: Openssl telling certificate has expired when it has not
body: <p>I'm having an issue with <code>curl</code> and <code>openssl</code> reporting a client certificate as expired, even though it's notAfter date is in the future:</p>
  
  <pre><code># echo | openssl s_client -showcerts -connect example.com:443 2&gt;&amp;1 | grep Verify
      Verify return code: 10 (certificate has expired)
  </code></pre>
  
  <p>But </p>
  
  <pre><code># echo | openssl s_client -showcerts -connect example.com:443 2&gt;&amp;1 | openssl x509 -noout -dates
  notBefore=Oct 17 00:00:00 2011 GMT
  notAfter=Oct 21 12:00:00 2014 GMT
  </code></pre>
  
  <p>System date is correct. Firefox is not showing any error for that site's cert either. Openssl versions I tried are <code>OpenSSL 1.0.1e-fips 11 Feb 2013</code> and <code>OpenSSL 1.0.1f 6 Jan 2014</code>. I've found a similar-looking issue <a href="https://groups.google.com/forum/#!topic/mailing.openssl.users/b9bOO85cpWE">here</a> where the author claims that the issue is missing in openssl 0.9.8, but present in 1.0.1.</p>
  
  <p>Why is this happening?</p>